Why Choose pfSense: Firewall

Why choose PFSense? PFSense is an excellent solution for professionals looking for a powerful firewall that's easy to set up on standard PC hardware. This particular distribution, however, is an open source project that also acts as a router: it's a very useful product for business and university settings, as well as for public bodies and government agencies.

The base software can be customised with a range of packages and plug-ins to implement various functions. Underneath it all is FreeBSD, a free and secure operating system; installation happens via a boot CD, with a preliminary phase followed by configuration through a web interface.

How does the PFSense firewall work?

The PFSense firewall can hold its own, in terms of quality, against much more expensive products on the market. For example, it includes a state table, which provides connection data and can be inspected at a granular level.

This is a Stateful Firewall, offering numerous management and state table optimisation options. These include:

• normal;

• conservative, so that legitimate connections aren't dropped;

• aggressive, which can drop legitimate connections but is more efficient and uses more resources;

• high latency, for use cases such as satellite links.

As for management options, worth noting besides the default one are modulate state and synproxy state. The first requires TCP (Transmission Control Protocol), while the second uses proxies that help servers under SYN flood attacks.

Another advantage is the ability to adjust the size of the state table. This tends to scale with RAM, but can also be enlarged in real time, keeping in mind that each state takes up roughly 1 KB.

What other features does PFSense offer?

Continuing on the features of the PFSense firewall, they also include what's known as Load Balancing: splitting workload across at least two servers. Worth mentioning too is High Availability, which lets you configure the software on two separate machines that automatically take over from one another in case one of them fails.

Anyone choosing PFSense also gets to take advantage of NAT (Network Address Translation): the goal is to modify the IP addresses in packet headers, so as to guarantee greater security.

The embedded version

This distribution is also available in an embedded version: it can be installed for a special purpose (a very specific use case), with an ad hoc platform.

Plenty of companies build dedicated hardware compatible with the embedded variant of PFSense. This covers both simpler architectures, such as microcontrollers, and more complex ones with integrated circuits.

PFSense and monitoring

Companies and professionals who rely on this Stateful Firewall have access to a detailed reporting system. This includes RRD graphs, with information on the software's overall condition, total and individual traffic, and CPU usage.

That's not all: these graphs also let you monitor the network gateway's ping response times, as well as traffic shaping trends (a set of operations aimed at making the most of available bandwidth). You can view both historical system data and real-time data such as free disk space, memory usage and more.

The captive portal

The PFSense firewall also offers a captive portal feature, handy if you frequently use hot-spot connections or want to add an extra layer of security. This tool is designed to redirect traffic to a different network authentication page, forcing it to be displayed. In marketing, this is very useful, because it lets you identify users and build statistics and buyer personas: a visitor to a given site is directed to a login screen, where they'll need to fill in a registration form. On top of that, PFSense's captive portal is useful for showing internet users a welcome message that highlights any responsibilities, access conditions and so on.

Community Support Has Real Limits

PFSense's community edition is free and well documented, which makes it a genuinely good starting point for a technically capable team. What it doesn't include is a vendor SLA: if a rule change breaks something at 7pm on a Friday, the community forum is the same resource whether you're a hobbyist or a business that can't afford the network to be down. That gap — not the software itself — is usually what pushes a business from a self-managed PFSense install toward a managed firewall service.

Rely on the professionals

For these services and for any other IT need or consultancy, rely on TN Solutions: our qualified technicians are always available to offer support and tailor-made solutions. We can also handle the supply of IT equipment (and more) directly through our e-commerce platform www.initpc.com, where you can find and order all kinds of products.