pfSense

The features we actually use: VPN, CARP and pfBlockerNG

We configure pfSense around the features an SME actually needs: OpenVPN and WireGuard for site-to-site links and remote access for staff working off-site, and IPsec for tunnels to partners and suppliers running different firewall brands. We set firewall rules around the network's real traffic instead of leaving factory defaults in place, and we segment the network into separate VLANs for offices, production and guest Wi-Fi, so a compromised device on one segment cannot reach the others.

For networks that cannot tolerate firewall downtime, we cluster two pfSense nodes with CARP: if the primary node fails, the secondary takes over the traffic with no noticeable interruption for users. We add pfBlockerNG to automatically block IP ranges from countries unrelated to the business and known threat lists, an extra filter before traffic even reaches the main firewall rules.

• OpenVPN and WireGuard for site-to-site links and remote access
• IPsec tunnels to suppliers and partners
• CARP for a high-availability firewall with no perceived downtime
• pfBlockerNG for automatic blocking of malicious IPs and threat lists
• VLANs to separate offices, production and guest network

When it fits an SME, and when it doesn't

pfSense is the right choice when a network needs custom rules a closed appliance won't allow, when VPN configuration needs granular control, or when a business wants to cut licensing costs tied to the firewall. We often propose it to companies with multiple sites that need a stable link between them, or to businesses with specific traffic requirements a generalist product doesn't handle well.

It is not the right fit when a business needs direct vendor hardware support with fast warranty replacement, or prefers a commercial appliance with a single point of contact for licensing, hardware and support: in those cases we work with WatchGuard, our other perimeter security partner. The choice between the two depends on the client's network requirements, not on a fixed preference.

How we work: from analysis to ongoing maintenance

Before configuring any rule we analyse the existing network: which sites need connecting, which services must stay reachable from outside, which departments need segmenting. We design the configuration around these requirements, test it in our lab in Melzo, near Milan, before moving it into production, and install it within a testing window agreed with the client, to confirm real traffic behaves as expected before we consider the project closed.

After installation we keep supporting the infrastructure: scheduled security updates, periodic rule reviews and support in case of hardware failure or an unexpected block. A pfSense firewall configured and then left untouched loses value over time, because threats and the business's traffic needs keep changing: the initial testing phase is the start of the relationship, not the end of it.

Configuration backups, updates and end of life

Every pfSense configuration we manage is saved and exported regularly, so in case of a hardware failure we can restore the rules onto a new appliance quickly, without rebuilding VPNs, NAT rules and network segments from scratch. We schedule version updates in an agreed window, checking first in the lab that installed packages, including pfBlockerNG, stay compatible, to avoid surprises on a network already in production.

The hardware pfSense runs on has a lifecycle like any network appliance: we monitor it and plan replacement before it becomes a risk, not after a failure. For businesses that prefer not to tie up capital in dedicated hardware, we also offer operational rental, with replacement already included in the refresh plan.