Video summary

EP 69: What's New in pfSense? Advanced Features for Smarter, Faster, and More Secure Networks

Main summary

Key takeaways

Technology

Technological Focus / Main Concepts

pfSense overview

  • pfSense is an open-source firewall + routing platform built on FreeBSD.
  • It’s positioned as a software-defined way to turn standard hardware into enterprise-grade security.
  • The emphasis is on FreeBSD’s mature, stable, high-speed network stack.

Why it’s different from hardware appliances

pfSense is framed as distinct from proprietary “big metal box” firewalls that are:

  • Closed source
  • Costly
  • Often require recurring licensing/subscriptions
  • Dependent on vendor patch timelines

In contrast, pfSense is presented as modular and user-controlled.

Open-source trust argument

The summary addresses concerns that open code could be less secure by countering with:

  • “Linus’s Law” / community auditing (“given enough eyeballs…”)
  • Faster vulnerability discovery and patching
  • An argument against security-by-obscurity, using open visibility to improve response speed

Security Architecture Explained (Features / Mechanics)

Zero Trust networking

  • No user/device/application is trusted by default.
  • Access requires continuous authenticate/authorize decisions.
  • Uses the idea of micro-perimeters for tighter control.

Advanced firewall rule management

Key advanced features include:

  • Granular rules

    • Example: allow specific devices to access specific services/ports, and drop everything else.

  • Interface-based policies

    • Rule evaluation happens top-down per interface.

  • Aliases / object management

    • Prevents repeatedly writing individual IP rules.
    • Aliases act like reusable “VIP lists.”

  • Stateful packet inspection (SPI) using connection context

    • Stateless inspection (described as packet-by-packet)
      • No memory, which can allow spoofed replies.
    • Stateful inspection
      • Uses a dynamic state table so replies are allowed only for connections initiated internally.

  • Schedule-based rules

    • Enforce time windows to reduce exposure.
    • Example: deny access to internal testing servers outside business hours to shrink attack surface.

IDS / IPS layer

  • pfSense integrates Suricata and Snort for intrusion detection/prevention.

Suricata vs Snort performance

  • Snort historically single-threaded
    • Can become CPU-bound on high throughput.
  • Suricata is multi-threaded
    • Better suited for high-bandwidth environments.

Signature update rationale

  • IDS/IPS rely on signature databases (byte/string/pattern fingerprints).
  • New ransomware and variants require frequent signature updates.
  • Without updates, traffic may not match signatures and could pass.

Secure remote access / VPN for remote work

Supported VPN options:

  • WireGuard
    • Positioned as fast and simpler (small code base, modern crypto primitives).
    • Good for lightweight remote access.
  • IPsec
    • Described as an interoperable “Swiss Army knife,” especially for legacy site-to-site tunnels.
    • Mentioned support like IKEv2 and kernel-level capabilities.
  • OpenVPN
    • Framed as a compatibility/masking option using SSL/TLS.
    • Can route over TCP 443 to resemble normal HTTPS in restrictive networks.

Network segmentation using VLANs (prevents lateral movement)

  • Uses 802.1Q VLAN tagging.
  • “Watertight compartment” analogy: segments reduce spread across zones.

Example:

  • VLAN 20 (IoT) can access the internet
  • VLAN 20 is forbidden from initiating connections to VLAN 10 (trusted)

Corporate examples include:

  • Separating HR vs marketing VLANs
  • Isolating guest Wi-Fi from corporate servers

Operational resilience & performance tradeoffs

Traffic shaping / QoS

  • Uses queuing algorithms to prevent congestion issues.
  • Protects real-time traffic (VoIP/video) from jitter.
  • Prioritizes by port/IP/protocol and throttles bulk transfers during congestion.

Multi-WAN and failover

  • Automatic failover via gateway monitoring.
  • Example approach: ICMP ping to external targets (e.g., DNS servers).
  • Routing tables update instantly.

High availability via CARP

  • Uses CARP (Common Address Redundancy Protocol).
  • Two pfSense devices share a virtual IP, sync state, and fail over instantly if the primary fails.

DNS security + privacy

  • Standard DNS is plaintext on port 53, so it can leak browsing targets.
  • DNS over TLS (DoT) is used:
    • pfSense acts as the internal resolver.
    • Encrypts queries to upstream on port 853.
  • Outsiders see encrypted DNS traffic instead of readable domains.

pfBlockerNG

  • DNS sinkhole/blacklists to block malware/command-and-control domains.
  • Can return null/blank destinations to prevent connections.
  • Supports geo-IP blocking to drop traffic from high-risk regions and reduce scanning noise.

Additional package capabilities

  • Squid proxy
    • Web proxy caching to reduce repeated downloads/bandwidth usage.
  • ACME (Let’s Encrypt automation)
    • Automatically renews SSL/TLS certificates to avoid outages from expired certs.
  • NUT (Network UPS Tools)
    • Integrates with UPS devices for graceful shutdown when power is low.

Administration Risks and Scaling Considerations (Practical Guidance / Analysis)

Human error risk (major theme)

  • pfSense’s flexibility/granularity can increase mistakes.
  • Example: a top rule of “deny all” above required management allow rules can cause lockout.

Mitigations:

  • Least privilege
  • MFA on the admin portal
  • XML configuration backups for fast rollback
    • Restore console and upload the last known-good XML.

Performance tuning / hardware compatibility

  • CPU capacity matters for features like IPS, VPN, DNS filtering, and large feed processing.
  • Example: VPN throughput can depend on instruction support such as AES-NI; without it, encryption can bottleneck.

Scalability examples

  • From home labs (learning VLANs/IPS) to:
    • Retail chains needing many IPsec site-to-site tunnels for POS/PCI compliance
    • Healthcare using VLAN isolation + IDS/IPS for ransomware detection (HIPAA context)

Claim: the same FreeBSD-based core scales with proper configuration discipline and hardware sizing.

Future Directions Mentioned

Next-Gen Firewall (NGFW) evolution

  • More native zero-trust integration
  • SD-WAN described as proactive and application-aware
    • Routes different traffic types over the best link
    • Less reactive than basic multi-WAN failover

Containerized deployments

  • Running virtual/containerized pfSense instances in cloud/edge environments.
  • Emphasizes infrastructure as code and fast provisioning.

AI-assisted threat detection

  • Aims to address signature-based IDS/IPS limitations against polymorphic malware.
  • Proposed model:
    • Machine learning builds a baseline of “normal” traffic behavior
    • Flags abnormal patterns, including potential “zero-day”-style deviations

Main Speakers / Sources Mentioned

  • Pen Content Digital (video sponsor mention)
  • Suricata and Snort (IDS/IPS engines discussed)
  • Linus’s Law (attributed to Linus Torvalds)
  • Google DNS (example endpoint for gateway monitoring/failover)
  • CISA’s firewall rules (referenced conceptually)
  • ACME / Let’s Encrypt
  • Squid, pfBlockerNG, NUT
  • No individual human host name is explicitly identified in the subtitles.

Original video