New Version of pfSense Firewall: Everything You Need to Know

The new open-source version of the pfSense firewall offers many of the features found in commercial firewalls and more. Each feature can be easily managed through a web interface, eliminating the need for command-line input.

State Table Overview

The State Table provides detailed information about active connections. By default, each rule is stateful, meaning it operates as a state firewall.

The new version of pfSense includes several options for precise control over the state table, including the ability to adjust its size. Typically, the state table's size adapts to the amount of RAM available, but you can manually increase it if necessary. Each state consumes about 1 KB of RAM, which is crucial when sizing memory. The firewall offers various options for state management. For instance, the Synproxy state allows proxies to establish TCP connections to protect servers from spoofed TCP SYN floods.

Network Access Control

New in pfSense Firewall The latest version of pfSense offers enhanced network security by closely monitoring access control. It also filters all incoming network traffic with ease. The firewall manages traffic filtering through policies that activate either default-deny or default-allow criteria.

• Default-deny blocks all network access unless explicitly allowed, offering a higher level of security.

• Default-allow, on the other hand, permits all access except what has been explicitly prohibited, which may allow unknown threats to slip through.

Network Address Translation (NAT)

Another key feature of the new pfSense version is its bridging mode, which allows transparent operation at Layer 2. The firewall also supports Network Address Translation (NAT) and high availability, enabling you to install two identical firewalls on separate devices. This setup allows for seamless redundancy—if one firewall fails, the other automatically takes over, ensuring network continuity.

Load balancing is another powerful feature, distributing various operations across multiple servers. pfSense can also act as an URL filter, web provider, and antivirus solution.

Redundancy

Hardware failover is managed using the CARP protocol from OpenBSD, allowing multiple hardware firewalls to operate as a failover cluster. If an interface on the primary device fails, or the device goes offline, the secondary firewall takes over automatically. Devices also feature automatic synchronization, ensuring that the state table remains identical across all devices, so existing connections are not interrupted during a failover.

Additional Features of the New pfSense Firewall

pfSense supports three types of VPN connectivity:

• PPTP Server

• IPsec

• OpenVPN

OpenVPN is a powerful and flexible SSL VPN solution, compatible with a wide range of client operating systems. The PPTP Server is built into most client operating systems, including Windows. Finally, IPsec enables connectivity with all devices supporting this protocol, commonly used in site-to-site configurations. It’s a popular choice for commercial firewalls such as Juniper and Cisco, as well as other open-source firewalls like mOnOwall.

Setting Up CARP High Availability: What's Actually Involved

Getting the redundancy described above working isn't automatic — it requires a few deliberate configuration steps on both firewalls:

1. A dedicated sync interface. CARP failover and state table synchronisation need their own interface, connected directly between the two firewalls (or on a dedicated VLAN) and never used for regular LAN traffic — mixing sync traffic with production traffic is one of the more common causes of an unstable HA pair.
2. A Virtual IP per protected network, configured under Firewall > Virtual IPs with type CARP: this is the address that clients and other devices actually use, and the one that migrates automatically between the two firewalls.
3. A matching VHID (Virtual Host ID) on both units for each CARP VIP, so the two firewalls recognise each other as members of the same failover group; using a VHID that's already in use elsewhere on the same network is a common source of unexplained failovers.
4. An advskew value set lower on the intended primary firewall (typically 0) and higher on the secondary (typically 100): this is what determines which unit is master under normal conditions.
5. State synchronisation (pfsync) enabled on the same dedicated interface, so that active connections survive a failover instead of every device having to reconnect from scratch.

Errors You'll Actually Run Into

• Both firewalls claim to be master at the same time — almost always a broken or disconnected sync interface: without it, each unit assumes the other is down and takes over, which can cause exactly the kind of conflict CARP is meant to prevent.
• CARP status flaps between MASTER and BACKUP repeatedly — usually a network issue on the sync link (packet loss, a flapping switch port) rather than a pfSense configuration problem; checking the sync interface's own link status is the first step.
• Failover works but existing connections drop anyway — pfsync (state synchronisation) isn't enabled or isn't running on the same interface as CARP, so the backup firewall takes over the IP but has no record of the sessions that were open on the primary.
• A VHID conflict with a neighbouring network — if another organisation on a shared or adjacent network happens to use the same VHID, both sets of firewalls can interfere with each other; choosing a less common VHID value avoids this in shared environments (data centres, coworking spaces).

Solutions at Your Fingertips

Need expert advice on using the latest pfSense firewall? TN Solutions offers a team of IT professionals ready to assist you. Contact us today for comprehensive IT support.

If you’re looking to purchase IT products or other materials, explore the vast product catalog on our e-commerce platform at initpc.com. Sign up for our newsletter to receive a free discount code every month!