Create a pfSense Firewall VM

Mathew J. Heath Van Horn, PhD

10 Create a pfSense Firewall VM

Mathew J. Heath Van Horn, PhD

This chapter introduces students to one of the most widely used open-source firewall platforms in enterprise, education, and small-to-medium business environments. Students install and configure a pfSense virtual machine that will later serve as the foundation for network segmentation, firewall rules, NAT, VPNs, and secure network architectures throughout the remainder of the book.

Phase 0 – Professional Alignment

Enterprise networks rely on firewalls to control traffic, protect critical systems, and enforce organizational security policies. In this chapter, you will install and configure a pfSense virtual firewall, developing foundational skills in network security and infrastructure deployment that are essential for network administrators and cybersecurity professionals.

DCWF Work Roles

The knowledge and skills developed in this chapter align with the following Department of Defense Cyber Workforce Framework (DCWF) work roles:

451 – System Security Analyst
511 – Network Operations Specialist
531 – Systems Administrator

NICE Work Roles

This chapter supports competencies associated with the following NICE Workforce Framework for Cybersecurity work roles:

Cyber Defense Infrastructure Support Specialist
Network Operations Specialist
Systems Administrator

Professional Skills

By completing this chapter, you will begin developing the ability to:

Deploy virtual firewall appliances in enterprise environments.
Configure firewall platforms to support secure network architectures.
Integrate security appliances into virtual network topologies.
Verify firewall operation and network connectivity.
Troubleshoot virtual appliance installation and interface configuration issues.
Prepare enterprise security infrastructure for future networking and cybersecurity laboratories.

What You’ll Be Able to Do

After completing this chapter, you should be able to:

Create and configure a pfSense virtual machine using Oracle VirtualBox.
Install pfSense and complete its initial configuration.
Configure network interfaces to support enterprise network connectivity.
Verify that the pfSense firewall operates correctly within your GNS3 environment.
Integrate the firewall into your enterprise networking laboratory for use in future exercises.
Prepare the pfSense platform for implementing firewall policies, network segmentation, and secure network services in subsequent chapters.

Learning Objectives

Successfully download, install, and run pfSense in VirtualBox

Prerequisites

Virtualbox Installed

Deliverables

None – this is a preparatory lab that supports other labs in this book

Resources

Download pfSense
How to install pfSense Firewall on Ubuntu and CentOS?

Contributors and Testers

TBD

Phase I – Download pfSense

pfSense is an operating system (OS) like Windows, Linux, or MacOS. pfSense is an open-source firewall and router software distribution based on FreeBSD, originating in 2004 as a fork of the m0n0wall project, with its first release in October 2006. Developed by Netgate, it offers features like stateful packet inspection, VPN support, and intrusion prevention.

Download the installer for pfSense Community Edition

NOTE: When this was written, Netgate made a surprising update requiring users to register for a new account and give up personal information to download the Community Edition image of pfSense. For many, this privacy compromise for corporate data harvesting is not worth this extra roadblock for learning. Therefore, we will provide two different methods for downloading pfSense.
1. The “Official” Method: From the publisher’s website
  
  NOTE: It is strongly advised to avoid using accurate personally identifiable information (PII) for online accounts you’ll only use once. Companies get hacked constantly; the last thing you want is your name, physical address, and phone number leaked just because you wanted to mess around with firewalls! However, when needed, you are not restricted from using temporary emails, phone numbers, or false addresses.
  
  NOTE: I downloaded the official Netgate website over a year ago and used my school email, address, and phone number. Not only is this publicly accessible information, but I have never received any spam or contact from Netgate – Mathew J. Heath Van Horn, PhD
2. The “Unofficial” Method:
  1. Many sites offer the pfSense Community Edition, version 2.7.2, for download. Because sites change constantly, we suggest you use your favorite search engine to find “pfSense 2.7.2 CE ISO”, but ensure you use a trusted website.
  2. You should download the .iso file named similarly to pfSense-CE-x.x.x-RELEASE-amd64.iso.gz. The .gz file extension stands for GNU Zip, a compression format commonly used. 7-Zip and other zip programs can usually unzip this file type. At the time of this writing, the Windows 11 internal zip function could not unzip the file

NOTE: Depending on where you get your image and your PC’s hardware, the installation steps may vary. You are pretty safe following the defaults for everything and stopping when the installer prompts you to reboot.

Please navigate to the folder where you downloaded the ISO and decompress (unzip) it
1. If you’re on Windows, use 7-Zip by right-clicking on the file
2. If you’re on Linux, use GNU unzip
  
  $ gunzip ~/Downloads/file-name.gz
You should now see a file name pfSense-CE-x.x.x-RELEASE-amd64.iso in your Downloads directory

Phase II – Create a pfSense VM

Creating a pfSense VM is a pretty standard exercise.

Start the Oracle VM VirtualBox Manager application

NOTE: This example uses VirtualBox GUI Version 7.0.X in the following steps. While your version may vary in organization and layout, the fundamental process should remain the same.

Figure 1 – Oracle VM VirtualBox Manager
At the top of the dashboard, select New

Figure 2 – Create a new Virtual Machine
A new sub-menu will appear
1. Name the VM as pfSense Firewall
2. Use the ISO image you unzipped earlier by clicking on the drop-down menu and navigating to where you unzipped it
3. Select the type “BSD”
4. Select the version as “FreeBSD (64-bit)”
5. Hit “Next”
  
  Figure 3 – ISO selection
Set the base memory to 1024MB

Figure 4 – Select the Base Memory
Hit “Next”
On the next menu, increase the virtual disk size to 20GB and press “Next”

Figure 5 – Select hard drive size
On the summary page, click “Finish”

Figure 6 – review and submit
This will create a new virtual machine in your VM list

Figure 7 – the new VM has been added to the menu

Phase III – Configure VM settings for the pfSense Server

Depending on your existing VirtualBox configuration, some configurations may already be applied.

Select (highlight) the pfSense-Firewall VM and then click Settings

Figure 8 – Settings on VM
Modify the Network settings to give the VM internet connectivity
1. On the left-side menu, select Network
2. Click the Adapter 1 tab
3. Ensure that Enable Network Adapter is selected
4. Attached to: NAT
  
  Figure 9a – Network settings on VM for adapter 1
5. Click on the Adapter 2 tab
  1. Ensure that Enable Network Adapter is selected
  2. Attached to: Internal Network
    
    Figure 9b – Network settings on VM for adapter 2
6. Click on the Adapter 3 tab
  1. Ensure that Enable Network Adapter is selected
  2. Attached to: Internal Network
    
    Figure 9c – Network settings on VM for adapter 3
Repeat for Adapter 4
Click on OK to save the new configuration settings

Phase IV – Installing the pfSense VM to the Virtual Hard Disk

Launch the pfSense VM like any other virtual machine.

Start the pfSense-Firewall virtual machine
Follow the installation guide to install pfSense in the VDI

NOTE: Place your mouse inside the VM and left-click to activate it. To navigate out of the VM, press the Right-Ctrl key on the keyboard.
1. Press Enter to accept the Copyright and distribution notice
  
  Figure 10 – Accept Licensing
2. Use the arrow keys to highlight Install and then tab to select OK and press Enter
  
  Figure 11 – Install pfSense
3. Hit Enter to set up the network installation
  
  Figure 12 – accept the network installation
4. Hit enter to select OK on the selected WAN interface – remember that Interface 1 (em0) is the only interface connected to the internet
  
  Figure 13 – Select the network interface
5. Hit Enter to proceed with the installation
  
  Figure 14 – Accept settings
6. Use the arrow keys to highlight WAN and then tab to select Continue and press Enter
  
  Figure 15a – Select WAN interface
7. Use the arrow keys to highlight LAN – interface 2 (em1), then tab to select Continue and press Enter
  
  Figure 15b – Select the LAN
8. Select continue, and press enter
  
  Figure 15c – Continue the install
9. Select continue, and press enter
  
  Figure 15d – select continu
10. Use tab to highlight Install CE and then press Enter
  
  Figure 16 – select CE install
11. Continue with the installation by pressing Enter
  
  Figure 17 – select continue
12. Continue with the stripe configuration by pressing Enter
  
  Figure 18 – agree to stripe installation
13. Continue with the hard drive disk selection by pressing Enter
  
  Figure 19 – Select the hard drive
14. Continue with the install by selecting Yes and pressing Enter
  
  Figure 20 – allow to continue
15. Use the arrow keys to select the Current Stable Release, then tab to OK and press Enter
  
  Figure 21 – select the stable release
16. When the installation is finished, use the tab key to select OK and press Enter
  
  Figure 22 – select OK to continue
DO NOT REBOOT AT THIS TIME – Uninstall the ISO boot-up CD first
1. Press the right-ctrl key to leave the virtual box interface
2. Navigate to the VM menu and select Devices, then Optical Drives, then the ISO
  
  Figure 23 – remove ISO
3. Force the Unmount
  
  Figure 24 – Force the Unmount
Use the tab key to select Reboot and press enter

Figure 25 – Reboot
You will get a bunch of errors; this is normal when you force an unmount. Just restart the pfSense – Firewall virtual machine, and it should boot normally
Wait a minute for the machine to reboot

Phase V – Post installation configurations

There isn’t much to do here, but some configuration is required. Remember, the virtual machine has three interfaces, so when it boots, it will have three. Use this chart to keep them straight.

Virtual Machine Name	pfSense name	Purpose
Interface 1	em0	WAN (access to the Internet)
Interface 2	em1	LAN (our internal network)
Interface 3	em2	DMZ (future)

You shouldn’t require post-installation configurations unless you forgot to configure the above. You can change those settings through this menu.

Figure 26 – Installation is complete

Career Connection

Firewalls are a foundational component of every modern enterprise network, serving as the first line of defense between trusted and untrusted networks. Network engineers, systems administrators, and cybersecurity professionals routinely deploy and manage firewall platforms such as pfSense to enforce security policies, control network access, and protect organizational assets. The experience gained in this chapter provides practical skills that transfer directly to enterprise IT operations, cybersecurity, cloud networking, and security engineering roles.

End of Lab

License

Icon for the Creative Commons Attribution-NonCommercial 4.0 International License