pfsense/pfsense
Pfsense
pfSense is an open-source operating system that turns a standard computer into a dedicated firewall and router with a web-based management interface. It runs on the FreeBSD kernel with the pf packet filter for stateful firewall and NAT processing, and manages all settings through a PHP-driven web interface that writes to XML configuration files.
The platform provides a comprehensive set of network security capabilities accessible through its browser-based control panel. Users can configure packet filtering rules to control traffic flow between network segments, manage network address translation to translate private IP addresses to public ones, and establish encrypted tunnels for remote access or site-to-site connectivity using IPsec, OpenVPN, WireGuard, or L2TP protocols. It also includes a captive portal engine that presents a login or acceptance page to users before granting network access on public or guest networks.
For advanced deployments, pfSense supports high availability through CARP failover protocol, pairing two firewalls in a failover cluster so one takes over seamlessly if the other goes offline. The system can be extended by installing third-party software packages through its built-in package manager, and provides real-time and historical performance monitoring through RRD-based graphing. Configuration can be backed up and restored to a file for disaster recovery.
Features
- Firewall Router Distributions - An open-source operating system that turns standard hardware into a dedicated firewall and router.
- Firewalls - Provides a stateful packet filtering firewall built on the FreeBSD pf kernel module.
- Configuration Layers - Manages all firewall settings through a PHP-driven web interface that writes to XML files.
- VPN - Creates and manages VPN tunnels through the web interface using IPsec, OpenVPN, WireGuard, or L2TP.
- Multi-Protocol VPN Gateways - Provides a VPN gateway supporting IPsec, OpenVPN, WireGuard, and L2TP protocols.
- Multi-Protocol VPN Servers - Configures VPN servers supporting IPsec, OpenVPN, WireGuard, and L2TP protocols.
- Network Traffic Routing - Directs data packets between networks using configurable routing rules from the web interface.
- Firewall Rule Configurations - Sets packet filtering rules to control traffic flow between network segments.
- Virtual Private Networks - Establishes encrypted VPN tunnels using IPsec, OpenVPN, WireGuard, and L2TP protocols.
- Network Address Translation - Provides NAT capabilities for translating private IPs to public addresses and port forwarding.
- Integrated Security Appliances - Integrates packet filtering, NAT, VPN, and traffic shaping into a single security platform.
- XML Configurations - Persists system state in a single XML file parsed at boot and reloaded on changes.
- Firewall Management Interfaces - Manages all firewall settings through a browser-based control panel without command-line editing.
- DHCP and DNS Services - Provides DHCP for automatic IP assignment and DNS for local hostname resolution.
- Plugin Package Managers - Provides a PHP-based package manager for installing third-party software extensions.
- Package Manager Installers - Installs and manages third-party software modules through a built-in package manager.
- High Availability Cluster Deployments - Pairs two firewalls in a failover cluster using CARP for seamless high availability.
- CARP Failover Implementations - Implements CARP protocol for stateful failover between paired firewall appliances.
- Firewall Failover Clusters - Implements CARP-based failover clustering for seamless firewall redundancy.
- Captive Portal Implementations - Ships a captive portal engine that intercepts HTTP traffic and redirects users to a login page.
- Network Switching and Bridging - Directs traffic between subnets and connects separate network segments at the data link layer.
- Firewall Package Extensions - Extends firewall capabilities by installing third-party software packages through a built-in package manager.
- Managed Identity Authentications - Controls access to the web interface and VPN services through local accounts or external authentication.
- Traffic Shaping and Prioritization - Supports traffic shaping and QoS to prioritize or limit bandwidth for critical applications.
