Skip to main content

Initial Configuration of pfSense Firewall

pfSense is a powerful open-source firewall and router distribution based on FreeBSD. On the Tilaa platform, it is often used as a gateway to protect other servers within a Private Network (VLAN) or as a VPN endpoint.

Step 1: First Boot & Interface Assignment

After deploying the pfSense appliance, you need to perform the initial interface assignment via the console.

  1. Log in to the MyTilaa Dashboard.
  2. Open the Video Display for your VPS.
  3. The setup wizard will ask to assign interfaces.
    • VLANs: Type n (No).
    • WAN Interface: Type vtnet0.
    • LAN Interface: Press Enter (leave empty for now).
  4. Confirm the settings with y.

Once the boot process finishes, you will see the console menu. Note the WAN IP address displayed.

Step 2: The Critical "Anti-Lockout" Rule

STOP! Read this before proceeding.
By default, pfSense allows access to the web interface via WAN. However, the moment you configure a LAN interface later, pfSense will block web access on WAN automatically.

You MUST create a manual "Allow" rule now, or you will lock yourself out in Step 3.
  1. Open your web browser and navigate to https://<your-wan-ip>.
  2. Log in with username admin and the password found in your Tilaa Dashboard.
  3. Complete the initial setup wizard (Hostname, DNS, Timezone).
  4. Go to Firewall > Rules > WAN.
  5. Click Add (Arrow pointing up/down) to create a new rule:
    • Action: Pass
    • Interface: WAN
    • Protocol: TCP
    • Source: Any (or restrict to your Office IP for security).
    • Destination: WAN Address.
    • Destination Port Range: HTTPS (443).
  6. Click Save and then Apply Changes.
Firewall rule allowing HTTPS on WAN

Step 3: Adding the Private Network (LAN)

Now that access is secured, we can add the internal network.

  1. Shut down the VPS via the Tilaa Dashboard.
  2. Go to the Network tab and add your Virtual Private Network interface.
  3. Start the VPS and open the Video Display again.

Re-assign Interfaces:

  1. In the console menu, select Option 1 (Assign Interfaces).
  2. WAN: vtnet0
  3. LAN: vtnet1 (This is the new interface).
  4. Confirm with y.

Step 4: Configuring the LAN IP

You must assign a static private IP to the LAN interface to act as the gateway for your other servers.

  1. In the console menu, select Option 2 (Set interface(s) IP address).
  2. Select the LAN interface (2).
  3. Enter a private IP (e.g., 10.0.0.1 or 172.16.0.1).
  4. Enter the subnet bit count (e.g., 24 for 255.255.255.0).
  5. Upstream Gateway: Press Enter (None).
  6. DHCP Server: Type n (No) unless you specifically need it. We recommend static IPs for servers.
Setup Complete!
Your pfSense is now ready. You can configure your other VPSs to use the LAN IP (e.g., 10.0.0.1) as their Default Gateway to route traffic through the firewall.
Tip: Enable Ping
By default, pfSense blocks ICMP (Ping) on WAN. To monitor your server, go to Firewall > Rules > WAN and add a rule to pass protocol ICMP (Echo Request).