Run any Skill in Manus with one click

pfsense

Stars5

Forks0

UpdatedJune 9, 2026 at 08:45

Manage the pfSense firewall at 10.0.20.1 via SSH. Use when: (1) User asks about firewall rules, NAT, port forwarding, (2) User asks about network diagnostics (ARP, routing, DNS, ping), (3) User asks about DHCP leases or static mappings, (4) User asks about VPN status (WireGuard, Tailscale), (5) User asks about pfSense services (Snort, FRR/BGP/OSPF, etc.), (6) User asks about firewall states, connections, or traffic, (7) User mentions "pfsense", "firewall", "gateway", or network troubleshooting, (8) User wants to check system health (CPU, memory, disk, temp) of pfSense. pfSense CE 2.7.2 on FreeBSD 14.0, VMID 101 on Proxmox.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

ViktorBarzin

ViktorBarzin/infra

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Network and Computer Systems AdministratorsComputer and Mathematical Occupations·SOC 15-1244

SKILL.md

readonly

More from this repository

same repository

cluster-health

ViktorBarzin/infra

Check Kubernetes cluster health and fix common issues. Use when: (1) User asks to check the cluster, check health, or "what's wrong", (2) User asks about pod status, node health, or deployment issues, (3) User asks to fix stuck pods, evicted pods, or CrashLoopBackOff, (4) User mentions "health check", "cluster status", "cluster health", (5) User asks "is everything running" or "any problems". Runs 49 cluster-wide checks (nodes, workloads, monitoring, certs, backups, external reachability, PVE host thermals + load, HA Sofia status dashboard, Immich smart-search, Proxmox CSI ghost-disk drift, Goldmane edge-aggregator, Slack #alerts recent alerts) with safe auto-fix for evicted pods.

2026-07-125

cluster-health

ViktorBarzin/infra

Personalized for emo. Check whether the homelab Kubernetes cluster is affecting ha-sofia or the Sofia smart-home devices it runs (Tuya devices, the MPPT ATS, lights, climate, security, irrigation). Use when: (1) "is ha-sofia ok", "are my devices / the ATS / the lights down", (2) "is the cluster affecting Sofia / my devices", (3) "check the cluster", "cluster health", "is everything running", (4) a device on the Барзини → Статус dashboard looks offline. Runs the cluster-wide healthcheck read-only and triages it by what ha-sofia actually depends on; the rest of the cluster is the admin's area.

2026-06-265

home-assistant

ViktorBarzin/infra

Control Home Assistant smart home devices and automations. Use when: (1) User asks to turn on/off lights, switches, or devices, (2) User asks about the state of sensors, devices, or entities, (3) User says "turn on the lights", "set temperature", "lock the door", (4) User asks to run a scene or script, (5) User asks "what devices are on?" or "is the door locked?", (6) User mentions smart home, IoT, or home automation. There are TWO Home Assistant deployments: ha-london (default) and ha-sofia. Always use Home Assistant for smart home control.

2026-06-245

upgrade-state

ViktorBarzin/infra

Audit the three autonomous-upgrade pipelines (apps via Keel, OS via unattended-upgrades+kured, K8s components via the version-check chain). Use when: (1) User asks "/upgrade-state" or "are we current", (2) User asks "what's pending upgrade" or "what's the upgrade state", (3) User asks if Keel / kured / k8s-version-check is healthy, (4) User asks about kept-back / held packages or pending reboots, (5) Periodic survey before the next `k8s-version-check` daily run. Read-only — no `--fix`. Exits 0 healthy / 1 attention / 2 stalled.

2026-06-175

add-user

ViktorBarzin/infra

Add a new namespace-owner to the Kubernetes cluster. Use when: (1) "add user", "onboard user", "create user", "new namespace-owner", (2) someone new needs their own namespace and CI access, (3) user asks to set up cluster access for a person. Interactive: asks questions, updates Vault KV, applies stacks.

2026-06-095

authentik-oidc-kubernetes

ViktorBarzin/infra

Configure Authentik as OIDC provider for Kubernetes API server authentication. Use when: (1) setting up OIDC auth for kubectl with Authentik, (2) kube-apiserver rejects OIDC tokens with "oidc: email not verified", (3) JWKS endpoint returns empty {} despite provider being configured, (4) kubelogin fails with "claim not present" for email, (5) redirect_uri mismatch errors during kubelogin browser auth, (6) kube-apiserver static pod manifest changes don't take effect after restart. Covers all gotchas discovered when integrating Authentik 2025.10.x with Kubernetes 1.34.x using kubelogin (int128/kubelogin).

2026-06-095

name	pfsense
description	Manage the pfSense firewall at 10.0.20.1 via SSH. Use when: (1) User asks about firewall rules, NAT, port forwarding, (2) User asks about network diagnostics (ARP, routing, DNS, ping), (3) User asks about DHCP leases or static mappings, (4) User asks about VPN status (WireGuard, Tailscale), (5) User asks about pfSense services (Snort, FRR/BGP/OSPF, etc.), (6) User asks about firewall states, connections, or traffic, (7) User mentions "pfsense", "firewall", "gateway", or network troubleshooting, (8) User wants to check system health (CPU, memory, disk, temp) of pfSense. pfSense CE 2.7.2 on FreeBSD 14.0, VMID 101 on Proxmox.
author	Claude Code
version	1.0.0
date	"2026-02-14T00:00:00.000Z"

pfSense Firewall Management

Overview

Host: 10.0.20.1 (Kubernetes VLAN gateway)
SSH: ssh admin@10.0.20.1
Version: pfSense CE 2.7.2, FreeBSD 14.0
Proxmox VMID: 101 (8 CPU, 16GB RAM, 32G disk)
Web UI: https://pfsense.viktorbarzin.me (via reverse proxy) or https://10.0.20.1
Installed packages: FRR (BGP/OSPF), Tailscale, Snort, WireGuard, REST API, FreeRADIUS

Interfaces

Name	Description	Physical	IP	Network
wan	WAN	vtnet0	192.168.1.2/24	Physical network
lan	Management VMs	vtnet1	10.0.10.1/24	VLAN 10
opt1	Kubernetes	vtnet2	10.0.20.1/24	VLAN 20
opt2	WireGuard	tun_wg0	10.3.2.1/24	VPN tunnel
tailscale0	Tailscale	tailscale0	100.64.0.x	Headscale mesh

CLI Script

Script: .claude/pfsense.py

Execution Pattern

cd ~/code/infra && python3 .claude/pfsense.py <command> [options]

Available Commands

System Information

python3 .claude/pfsense.py status          # Full system overview
python3 .claude/pfsense.py uptime          # Uptime
python3 .claude/pfsense.py cpu             # CPU info and load
python3 .claude/pfsense.py memory          # Memory breakdown
python3 .claude/pfsense.py disk            # Disk usage
python3 .claude/pfsense.py temp            # CPU temperature
python3 .claude/pfsense.py pkg-list        # Installed packages

Network & Interfaces

python3 .claude/pfsense.py interfaces      # Interface list with IPs
python3 .claude/pfsense.py gateways        # Gateway status
python3 .claude/pfsense.py arp             # ARP table
python3 .claude/pfsense.py routes          # Routing table
python3 .claude/pfsense.py dns-resolve <host>  # DNS lookup via pfSense
python3 .claude/pfsense.py diag <host>     # Ping test

Firewall

python3 .claude/pfsense.py rules           # All firewall rules
python3 .claude/pfsense.py rules opt1      # Rules for Kubernetes interface
python3 .claude/pfsense.py nat             # NAT / port forwarding rules
python3 .claude/pfsense.py aliases         # List all aliases
python3 .claude/pfsense.py alias <name>    # Show alias members
python3 .claude/pfsense.py states          # State table summary
python3 .claude/pfsense.py states-top 20   # Top 20 IPs by connection count

DHCP

python3 .claude/pfsense.py dhcp-leases         # All DHCP leases
python3 .claude/pfsense.py dhcp-leases opt1    # Kubernetes network leases only

Services

python3 .claude/pfsense.py services                    # List all services + status
python3 .claude/pfsense.py service restart snort        # Restart a service
python3 .claude/pfsense.py service stop wireguard       # Stop a service
python3 .claude/pfsense.py service start wireguard      # Start a service

VPN & Routing

python3 .claude/pfsense.py wireguard       # WireGuard tunnel status
python3 .claude/pfsense.py tailscale       # Tailscale/Headscale status
python3 .claude/pfsense.py bgp             # BGP summary (FRR)
python3 .claude/pfsense.py ospf            # OSPF neighbors (FRR)

Security

python3 .claude/pfsense.py snort           # Snort IDS status + recent alerts
python3 .claude/pfsense.py logs            # Last 50 firewall log entries
python3 .claude/pfsense.py logs 200        # Last 200 entries
python3 .claude/pfsense.py logs-filter "blocked"  # Search logs

Advanced

python3 .claude/pfsense.py pfctl "-sr"     # Raw pfctl command
python3 .claude/pfsense.py php "echo phpversion();"  # Run PHP on pfSense
python3 .claude/pfsense.py raw "ls /tmp"   # Run arbitrary shell command
python3 .claude/pfsense.py backup          # Dump config.xml to stdout

Direct SSH Access

For tasks not covered by the script, SSH directly:

ssh admin@10.0.20.1 "<command>"

Useful Direct Commands

# pfSense PHP shell (interactive config access)
ssh admin@10.0.20.1 "php -r 'require_once(\"config.inc\"); \$cfg = parse_config(true); echo json_encode(\$cfg[\"nat\"], JSON_PRETTY_PRINT);'"

# pfSsh.php playback commands
ssh admin@10.0.20.1 "pfSsh.php playback gatewaystatus"
ssh admin@10.0.20.1 "pfSsh.php playback svc restart snort"
ssh admin@10.0.20.1 "pfSsh.php playback listpkg"

# Config sections via PHP
ssh admin@10.0.20.1 "php -r 'require_once(\"config.inc\"); \$cfg = parse_config(true); print_r(\$cfg[\"filter\"][\"rule\"][0]);'"

# FRR/vtysh for routing
ssh admin@10.0.20.1 "/usr/local/bin/vtysh -c 'show ip route'"
ssh admin@10.0.20.1 "/usr/local/bin/vtysh -c 'show bgp ipv4 unicast'"

REST API (pfSense-pkg-RESTAPI v2.2)

The REST API package is installed but no API keys are configured. To use it:

Create an API key in pfSense Web UI: System > REST API > Settings > Keys
Use Bearer token auth: curl -sk https://10.0.20.1/api/v2/status/system -H 'Authorization: Bearer <key>'

Until API keys are set up, use SSH for all operations.

Key Services

Service	Status	Notes
FRR (BGP/OSPF)	Running	Routing daemon
Snort	Running	IDS/IPS
WireGuard	Running	VPN tunnel (10.3.2.0/24)
Tailscale	Running	Mesh VPN via Headscale
FreeRADIUS	Running	RADIUS auth
DHCP (Kea)	Running	kea-dhcp4
SSH	Running	Admin access
NTP	Running	Time sync

Firewall Stats

167 firewall rules (pfctl -sr)
154 NAT rules (pfctl -sn)
~784 active states (varies)
10 aliases (LAN, OPT1, OPT2, WAN networks + custom)

NFS Backup

Config backups stored at NFS: /mnt/main/pfsense-backup

Troubleshooting

Issue	Command
Can't reach internet from K8s	`python3 .claude/pfsense.py gateways` + `python3 .claude/pfsense.py diag 8.8.8.8`
K8s pod can't reach external	`python3 .claude/pfsense.py rules opt1` + check NAT
DHCP not working	`python3 .claude/pfsense.py dhcp-leases opt1` + `python3 .claude/pfsense.py service restart kea-dhcp4`
High connection count	`python3 .claude/pfsense.py states-top 20`
Snort blocking traffic	`python3 .claude/pfsense.py snort` + check alerts
DNS resolution failing	`python3 .claude/pfsense.py dns-resolve <host>`
BGP/OSPF routes missing	`python3 .claude/pfsense.py bgp` or `python3 .claude/pfsense.py ospf`
WireGuard tunnel down	`python3 .claude/pfsense.py wireguard`

Notes

FreeBSD-based: Commands differ from Linux (no ip, use ifconfig, netstat, arp)
pfctl is the firewall: Rules loaded from config.xml via PHP, managed by pfctl
Config file: /cf/conf/config.xml — all pfSense config in one XML file
PHP shell: pfSense uses PHP for all config management; config.inc loads the config
Do NOT edit config.xml directly — use the Web UI or PHP functions that properly reload services
Logs: Binary circular logs, read with clog -f /var/log/<logfile>