Implementing a pfSense Firewall

This setup is for people who aren’t planning on buying a Netgate appliance, for whatever the reason turns out to be. For my home network I put cost first. The pfSense software itself is free from Netgate, and the hardware this build needs keeps the total low — comparable to a Netgate 1100 at $269, with considerably more compute for the money.

What you need

Two options are listed for each component so you can pick on price or on brand familiarity. You need one item from each group, not both.

A mini PC and an access point puts you around $250 to $290 all in, and you get a multi-core x86 box with 8 GB of RAM instead of an ARM SoC with 1 GB. That headroom is the whole argument for this route: it’s what lets you add packages later without the firewall becoming the bottleneck.

Before you buy, ask yourself

• What are your plans for the hardware? A firewall alone, or a firewall plus IDS, DNS filtering and a VPN endpoint?
• What is your budget, including the access point and the cabling?
• What are your preferred cabling standards — patch cables off the shelf, or your own runs terminated in place?

Step 1 — Create the install media

On your main computer, download the Netgate Installer, then write it to the USB stick with Rufus on Windows or Balena Etcher on Linux or macOS. Both will erase the stick.

Three controls, in order: Flash from file to pick the Netgate image you downloaded, Select target to pick the USB stick, then Flash. Read the target twice before you commit — Etcher will happily write to an external drive if you hand it one. The clip stops partway through the write; the whole thing takes a few minutes depending on the stick, and Etcher verifies the image afterwards on its own.

Step 2 — Install on the mini PC

Plug the USB stick into the mini PC and power it on. Nothing needs to be connected to the network yet.

• Get into the BIOS. The key varies by manufacturer — try F1, F2, F3, F11 or Del, tapping it as the machine powers on.
• Turn off Secure Boot.
• Move the USB stick to the top of the boot order, so the machine boots from it rather than from the internal SSD.
• Save and exit. The installer will come up.
• Delete all partitions on the internal drive, unless you have a specific reason to keep them. This is a dedicated firewall now.
• When the installer finishes, the machine reboots. Pull the USB stick out during that reboot so it doesn’t start the installer again.

Step 3 — Assign the interfaces

After the reboot, pfSense asks which physical port is which. On a two-port box the split is simple:

• WAN — the uplink, going to your modem or ONT.
• LAN — the downlink, going to your access point.

Rather than guessing at interface names, type a at the assignment prompt and let pfSense auto-detect. It will ask you to connect a cable to one port at a time and will name whichever port sees link. Only plug a cable in when it tells you to — that’s the entire point of the process.

Step 4 — First login

Get onto the LAN side, either over the SSID your access point is broadcasting or with a laptop cabled straight into the pfSense box. Then browse to the default address:

https://192.168.1.1

Username: admin
Password: pfsense

You’ll be walked through changing that password immediately. Do it — those credentials are published in Netgate’s own documentation, which means everyone has them.

Changing the LAN subnet

If you’d rather not sit on 192.168.1.0/24 like every consumer router on the street, change it now:

Interfaces → LAN → Static IPv4 Configuration → IPv4 Address

Do this before you connect anything else. Every device that joins afterwards picks up the new range on its own; devices already holding a lease on the old one have to renew, and that’s an annoyance you can simply skip by reordering the work.

What you have when the wizard finishes

Your access point is broadcasting, your router is live, and the firewall is already doing useful work. There’s a deep bench of security capability in pfSense you haven’t touched yet, but Netgate ships sane defaults: default deny inbound on WAN, default allow outbound on LAN. Unsolicited traffic dies at the edge of your network, and nothing about the way your household uses the internet changes. That is the correct posture to start from, and it’s worth understanding before you start writing rules of your own — most of what people break on day one, they break by loosening something that was already right.

Problems during deployment

Two panics on this build, both hardware-specific. Neither is a reason to avoid the route, but if you hit them, here is what they were.

Intel 7265 WiFi firmware panic

On version 2.8.1 the installer picked up the mini PC’s wireless card and panicked on the firmware load. This may or may not happen to you — it depends entirely on the card in your box. Disabling the driver didn’t hold, so I opened the case and physically removed the card. The firewall has no use for it anyway; wireless is the access point’s job in this design.

acpi_spmc panic

After upgrading, a known 2.9.0 erratum showed up: the acpi_spmc driver panicked right after initializing. The fix is a loader tunable, made permanent in /boot/loader.conf.local:

hint.acpi_spmc.0.disabled=1

Putting it in loader.conf.local rather than loader.conf matters — the latter gets overwritten on upgrade, and you would be chasing the same panic again on the next release.

Where this series goes next

This entry gets a firewall in place and leaves it at Netgate’s defaults. The rest of the series builds on this same box.

#pfsense #firewall #homelab #networksecurity #infosec

Affiliate disclosure: as an Amazon Associate I earn from qualifying purchases. Links marked to Amazon above are affiliate links; the price you pay is unchanged. Hardware prices were accurate as of September 2026.

Discuss
Discuss on LinkedIn More pfSense guides