| name | configuring-pfsense-firewall-rules |
| description | Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels, and traffic shaping to enforce network segmentation and control traffic between zones such as DMZ, internal, guest, and IoT. Use when deploying a pfSense perimeter or internal firewall, setting up port-forwarding NAT, configuring site-to-site or remote-access VPNs, or applying QoS/bandwidth policies.
|
| domain | cybersecurity |
| subdomain | network-security |
| tags | ["network-security","pfsense","firewall","nat","network-segmentation"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"] |
| mitre_attack | ["T1071.001","T1095","T1572","T1571","T1041"] |
Configuring pfSense Firewall Rules
When to Use
- Deploying a perimeter or internal firewall to segment and protect network zones (DMZ, internal, guest, IoT)
- Creating granular access control rules to restrict traffic between VLANs and network segments
- Configuring NAT rules for port forwarding to internal services exposed to the internet
- Setting up site-to-site or remote access VPN tunnels using IPsec or OpenVPN
- Implementing traffic shaping and bandwidth management for quality-of-service requirements
Do not use as a substitute for host-based firewalls on individual systems, for SSL/TLS deep packet inspection without dedicated hardware acceleration, or as the sole security control without complementary IDS/IPS.
Prerequisites
- pfSense 2.7+ installed on dedicated hardware or virtual machine with at least two network interfaces
- Access to the pfSense WebConfigurator (default: https://192.168.1.1)
- Network topology diagram showing all interfaces, VLANs, and desired traffic flow
- DNS and DHCP configuration planned for each network zone
- Understanding of TCP/IP, NAT, and stateful firewall concepts
Workflow
Step 1: Configure Network Interfaces and VLANs
Access the pfSense WebConfigurator and define interfaces:
Navigate: Interfaces > Assignments
WAN Interface (igb0):
- Type: DHCP or Static IP from ISP
- Block private networks: Enabled
- Block bogon networks: Enabled
LAN Interface (igb1):
- IPv4: 10.10.1.1/24
- Description: CORPORATE_LAN
Create VLANs:
Navigate: Interfaces > VLANs > Add
- VLAN 10 on igb1: DMZ (10.10.10.1/24)
- VLAN 20 on igb1: SERVERS (10.10.20.1/24)
- VLAN 30 on igb1: GUEST (10.10.30.1/24)
- VLAN 40 on igb1: IOT (10.10.40.1/24)
Assign VLANs:
Navigate: Interfaces > Assignments > Add each VLAN
Enable each interface and assign the gateway IP
Step 2: Configure DHCP and DNS for Each Zone
Navigate: Services > DHCP Server
CORPORATE_LAN (10.10.1.0/24):
Range: 10.10.1.100 - 10.10.1.200
DNS: 10.10.20.10 (internal DNS server)
Gateway: 10.10.1.1
DMZ (10.10.10.0/24):
Range: 10.10.10.100 - 10.10.10.200
DNS: 10.10.20.10
Gateway: 10.10.10.1
GUEST (10.10.30.0/24):
Range: 10.10.30.100 - 10.10.30.200
DNS: 1.1.1.1, 8.8.8.8 (public DNS only)
Gateway: 10.10.30.1
Navigate: Services > DNS Resolver
Enable DNS Resolver on all interfaces except GUEST
Enable DNSSEC
Configure forwarding to upstream DNS servers
Step 3: Create Firewall Rule Aliases
Navigate: Firewall > Aliases
RFC1918_Networks:
Type: Network
Values: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
WebPorts:
Type: Port
Values: 80, 443
ManagementPorts:
Type: Port
Values: 22, 3389, 5900
CriticalServers:
Type: Host
Values: 10.10.20.10, 10.10.20.11, 10.10.20.12
BlockedCountries:
Type: URL Table
URL: https://www.ipdeny.com/ipblocks/data/aggregated/cn-aggregated.zone
Update: 24 hours
