Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Configuring pfSense Firewall Rules · mukul975 | DecimalAI

Configuring Pfsense Firewall Rules

SkillScore55Maintained

configuring-pfsense-firewall-rules

Configures pfSense firewall rules, NAT policies, VPN tunnels, and traffic shaping to enforce network segmentation, control traffic flow, and protect internal network zones in enterprise and small-to-medium business environments.

DevOpsby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/configuring-pfsense-firewall-rules/SKILL.md

decimalai skills pull configuring-pfsense-firewall-rules --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/configuring-pfsense-firewall-rules/SKILL.md https://app.decimal.ai/s/configuring-pfsense-firewall-rules/SKILL.md

Raw file: /s/configuring-pfsense-firewall-rules/SKILL.md ↗ · machine-readable summary at /s/configuring-pfsense-firewall-rules.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

—+124% tokens0% turns55% of whole cases pass with skill (12/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-10	✗→✓	▲ Improved	—	—
case-17	✗→✓	▲ Improved	—	—
case-14	✗→✓	▲ Improved	—	—
case-16	✗→✓	▲ Improved	—	—
case-15	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/configuring-pfsense-firewall-rules/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Configuring pfSense Firewall Rules

When to Use

Deploying a perimeter or internal firewall to segment and protect network zones (DMZ, internal, guest, IoT)
Creating granular access control rules to restrict traffic between VLANs and network segments
Configuring NAT rules for port forwarding to internal services exposed to the internet
Setting up site-to-site or remote access VPN tunnels using IPsec or OpenVPN
Implementing traffic shaping and bandwidth management for quality-of-service requirements

Do not use as a substitute for host-based firewalls on individual systems, for SSL/TLS deep packet inspection without dedicated hardware acceleration, or as the sole security control without complementary IDS/IPS.

Prerequisites

pfSense 2.7+ installed on dedicated hardware or virtual machine with at least two network interfaces
Access to the pfSense WebConfigurator (default: https://192.168.1.1)
Network topology diagram showing all interfaces, VLANs, and desired traffic flow
DNS and DHCP configuration planned for each network zone
Understanding of TCP/IP, NAT, and stateful firewall concepts

Workflow

Step 1: Configure Network Interfaces and VLANs

Access the pfSense WebConfigurator and define interfaces:

Navigate: Interfaces > Assignments

WAN Interface (igb0):
  - Type: DHCP or Static IP from ISP
  - Block private networks: Enabled
  - Block bogon networks: Enabled

LAN Interface (igb1):
  - IPv4: 10.10.1.1/24
  - Description: CORPORATE_LAN

Create VLANs:
  Navigate: Interfaces > VLANs > Add
  - VLAN 10 on igb1: DMZ (10.10.10.1/24)
  - VLAN 20 on igb1: SERVERS (10.10.20.1/24)
  - VLAN 30 on igb1: GUEST (10.10.30.1/24)
  - VLAN 40 on igb1: IOT (10.10.40.1/24)

Assign VLANs:
  Navigate: Interfaces > Assignments > Add each VLAN
  Enable each interface and assign the gateway IP

Step 2: Configure DHCP and DNS for Each Zone

Navigate: Services > DHCP Server

CORPORATE_LAN (10.10.1.0/24):
  Range: 10.10.1.100 - 10.10.1.200
  DNS: 10.10.20.10 (internal DNS server)
  Gateway: 10.10.1.1

DMZ (10.10.10.0/24):
  Range: 10.10.10.100 - 10.10.10.200
  DNS: 10.10.20.10
  Gateway: 10.10.10.1

GUEST (10.10.30.0/24):
  Range: 10.10.30.100 - 10.10.30.200
  DNS: 1.1.1.1, 8.8.8.8 (public DNS only)
  Gateway: 10.10.30.1

Navigate: Services > DNS Resolver
  Enable DNS Resolver on all interfaces except GUEST
  Enable DNSSEC
  Configure forwarding to upstream DNS servers

Step 3: Create Firewall Rule Aliases

Navigate: Firewall > Aliases

RFC1918_Networks:
  Type: Network
  Values: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

WebPorts:
  Type: Port
  Values: 80, 443

ManagementPorts:
  Type: Port
  Values: 22, 3389, 5900

CriticalServers:
  Type: Host
  Values: 10.10.20.10, 10.10.20.11, 10.10.20.12

BlockedCountries:
  Type: URL Table
  URL: https://www.ipdeny.com/ipblocks/data/aggregated/cn-aggregated.zone
  Update: 24 hours

Step 4: Implement Firewall Rules by Zone

Navigate: Firewall > Rules

=== WAN Rules ===
# Block all inbound by default (implicit deny)
# Allow established/related traffic (automatic in pfSense stateful mode)

# Allow inbound to DMZ web server (via NAT)
Action: Pass | Interface: WAN | Protocol: TCP
Source: any | Destination: WAN Address | Port: 80, 443
Description: Allow HTTP/HTTPS to DMZ web server

=== LAN Rules ===
# Allow LAN to access internal servers
Action: Pass | Interface: LAN | Protocol: TCP
Source: LAN net | Destination: SERVERS net | Port: WebPorts, 3306, 5432
Description: Allow LAN to internal web and database servers

# Allow LAN to internet
Action: Pass | Interface: LAN | Protocol: any
Source: LAN net | Destination: ! RFC1918_Networks
Description: Allow LAN to internet (block inter-VLAN via RFC1918 exclusion)

# Block LAN to IoT (explicit deny before implicit allow)
Action: Block | Interface: LAN | Protocol: any
Source: LAN net | Destination: IOT net
Description: Block direct LAN to IoT communication

=== DMZ Rules ===
# Allow DMZ web servers to query internal DNS
Action: Pass | Interface: DMZ | Protocol: TCP/UDP
Source: DMZ net | Destination: 10.10.20.10 | Port: 53
Description: Allow DMZ DNS queries to internal resolver

# Allow DMZ to internet for updates only
Action: Pass | Interface: DMZ | Protocol: TCP
Source: DMZ net | Destination: any | Port: 80, 443
Description: Allow DMZ outbound HTTP/HTTPS for updates

# Block all other DMZ traffic
Action: Block | Interface: DMZ | Protocol: any
Source: DMZ net | Destination: any
Description: Default deny for DMZ

=== GUEST Rules ===
# Allow guest to internet only (DNS and web)
Action: Pass | Interface: GUEST | Protocol: TCP/UDP
Source: GUEST net | Destination: ! RFC1918_Networks | Port: 53, 80, 443
Description: Allow guest internet access only

# Block all guest to internal
Action: Block | Interface: GUEST | Protocol: any
Source: GUEST net | Destination: RFC1918_Networks
Description: Block guest access to all internal networks

=== IOT Rules ===
# Allow IoT to specific cloud endpoints
Action: Pass | Interface: IOT | Protocol: TCP
Source: IOT net | Destination: ! RFC1918_Networks | Port: 443, 8883
Description: Allow IoT HTTPS and MQTT to cloud

# Block IoT inter-device communication
Action: Block | Interface: IOT | Protocol: any
Source: IOT net | Destination: IOT net
Description: Prevent IoT lateral movement

# Block IoT to all internal networks
Action: Block | Interface: IOT | Protocol: any
Source: IOT net | Destination: RFC1918_Networks
Description: Block IoT access to internal

Step 5: Configure NAT Rules

Navigate: Firewall > NAT > Port Forward

# Web server in DMZ
Interface: WAN | Protocol: TCP
Destination: WAN address | Port: 443
Redirect target IP: 10.10.10.50 | Port: 443
NAT Reflection: Enable
Description: HTTPS to DMZ web server

# SSH jump host (non-standard port)
Interface: WAN | Protocol: TCP
Destination: WAN address | Port: 2222
Redirect target IP: 10.10.20.11 | Port: 22
Description: SSH to internal jump host via port 2222

Navigate: Firewall > NAT > Outbound
Mode: Hybrid Outbound NAT
# Add rule for DMZ servers to use a dedicated public IP
Interface: WAN | Source: 10.10.10.0/24
Translation Address: <dedicated_public_ip>
Description: DMZ outbound NAT via dedicated IP

Step 6: Enable Logging and Monitoring

Navigate: Status > System Logs > Settings
  Remote Logging: Enable
  Remote log servers: 10.10.20.15:514 (Syslog/SIEM)
  Log firewall default blocks: Enabled

Navigate: Firewall > Rules
  Enable logging on critical rules:
  - All BLOCK rules
  - WAN inbound PASS rules
  - Inter-VLAN PASS rules

Navigate: Diagnostics > pfTop
  Monitor real-time connection states and bandwidth usage

Install pfBlockerNG package:
  Navigate: System > Package Manager > Available Packages
  Install pfBlockerNG-devel
  Configure IP blocklists (Spamhaus DROP, Emerging Threats)
  Configure DNSBL for malware domain blocking

Step 7: Backup and Test Configuration

bash
# Export configuration backup
Navigate: Diagnostics > Backup & Restore
Download XML configuration file

# Test rules from each zone
# From LAN:
curl -I https://10.10.20.10  # Should succeed (LAN to SERVERS)
curl -I https://10.10.40.5   # Should fail (LAN to IOT blocked)

# From GUEST:
curl -I https://www.google.com  # Should succeed (internet)
curl -I https://10.10.20.10     # Should fail (guest to internal blocked)

# From DMZ:
nslookup google.com 10.10.20.10  # Should succeed (DNS allowed)
ssh 10.10.1.50                    # Should fail (DMZ to LAN blocked)

# Verify logging
Navigate: Status > System Logs > Firewall
Check that blocked and passed traffic is logging correctly

# Schedule automated config backups
Navigate: Diagnostics > AutoConfigBackup
Enable automatic backups to Netgate cloud or local storage

Key Concepts

| Term | Definition | |------|------------| | Stateful Firewall | Firewall that tracks the state of network connections and automatically allows return traffic for established sessions without explicit rules | | Alias | Named group of IP addresses, networks, or ports in pfSense that simplifies rule management and improves readability | | NAT (Network Address Translation) | Translation of IP addresses between internal and external networks, including port forwarding for inbound access to internal services | | Floating Rules | pfSense rules that apply across multiple interfaces simultaneously, processed before per-interface rules | | pfBlockerNG | pfSense package that integrates IP reputation blocklists and DNS-based blocklists for automated threat blocking | | Rule Processing Order | pfSense evaluates rules top-to-bottom within each interface tab; first match wins, and unmatched traffic is blocked by default |

Tools & Systems

pfSense 2.7+: Open-source firewall and router platform based on FreeBSD with web-based management and extensive package ecosystem
pfBlockerNG: IP and DNS blocklist package for automated threat intelligence integration
Snort/Suricata packages: IDS/IPS integration available as pfSense packages for inline traffic inspection
OpenVPN/IPsec: Built-in VPN implementations for site-to-site and remote access connectivity
Netgate AutoConfigBackup: Cloud-based configuration backup service for pfSense disaster recovery

Common Scenarios

Scenario: Segmenting a Small Business Network with pfSense

Context: A medical practice needs to segment its network to meet HIPAA requirements. They have a single internet connection, an electronic health records (EHR) server, staff workstations, a guest WiFi network, and medical IoT devices (vitals monitors, imaging equipment). Budget constraints require an open-source solution.

Approach:

Deploy pfSense on a Netgate 4100 appliance with four physical interfaces (WAN, LAN, DMZ, MGMT)
Create VLANs for staff (VLAN 10), EHR servers (VLAN 20), guest WiFi (VLAN 30), and medical devices (VLAN 40)
Configure strict rules: staff VLAN can access EHR servers on HTTPS only; medical devices can communicate only with the EHR server on specific ports; guest WiFi gets internet-only access with no internal routing
Enable pfBlockerNG with healthcare-specific threat feeds and malware domain blocking
Configure outbound NAT to prevent internal IP addresses from leaking to the internet
Enable comprehensive logging and forward all firewall logs to a SIEM via syslog
Set up automated configuration backups and document the rule base for audit compliance

Pitfalls:

Creating rules that are too permissive ("allow any any") instead of specific port-based rules
Forgetting the rule processing order -- placing a broad PASS rule above a specific BLOCK rule
Not enabling logging on critical rules, making incident investigation impossible
Allowing IoT devices unrestricted internet access, creating potential data exfiltration paths

Output Format

## pfSense Firewall Configuration Report

**Device**: pfSense 2.7.2 on Netgate 4100
**Interfaces**: WAN (igb0), LAN (igb1), DMZ (igb2), MGMT (igb3)
**VLANs**: 4 configured (Staff, Servers, Guest, IoT)
**Total Rules**: 28 active rules across all interfaces

### Rule Summary by Interface

| Interface | Pass Rules | Block Rules | Logging Enabled |
|-----------|-----------|-------------|-----------------|
| WAN | 2 | 1 (default) | Yes |
| LAN | 4 | 2 | Yes (blocks) |
| DMZ | 3 | 1 (default) | Yes |
| GUEST | 1 | 2 | Yes |
| IOT | 1 | 3 | Yes |

### Security Controls
- pfBlockerNG: 12 IP blocklists + DNSBL enabled
- Snort IDS: Running on WAN and LAN interfaces
- VPN: OpenVPN remote access configured with MFA
- Logging: All traffic forwarded to SIEM (10.10.20.15)

Illustrative Want to see what configuring-pfsense-firewall-rules would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 15:37 UTC · 22 cases

Measured on 21 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+41%

55% vs 14%

Agent turns

1.0 vs 1.0

Tokens

+124%

5,252.57 vs 2,345.71

fail → pass · 9pass → pass · 3fail → fail · 10

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-12 We have a web server in the DMZ (10.10.10.50) that needs to be accessible from the internet on port 443. How do we configure the NAT rule?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 Configuring the DMZ segment for our web servers. They need to resolve DNS and get OS updates from the internet. What outbound rules should be applied?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Setting up the IoT network segment. I need them to reach cloud endpoints on HTTPS and MQTT, but they shouldn't talk to each other or the internal network. What rules are needed?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-20 I am configuring new VLANs on my pfSense appliance using the igb1 interface. Should I assign an IP address directly to the igb1 parent interface?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 How do I set up SSL/TLS deep packet inspection on a standard Netgate 1100 router for all employee traffic?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 What is the recommended method for scheduling automated configuration backups for our Netgate appliance?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 We need to block all traffic from China using an alias that updates automatically. How is this alias configured?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-06 I want to deploy a dedicated intrusion detection system on a span port using Suricata on a Linux box. How do I configure the span port monitoring?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 We are setting up a central SIEM at 10.10.20.15. How should the firewall's system logs be configured to send data there?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-07 Setting up the main internet-facing interface on our Netgate appliance. It gets a DHCP address from the ISP. What specific security toggles should be enabled on this interface?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 I need to configure a local packet filter on my Ubuntu web server to block incoming traffic except ports 80, 443, and 22. What commands should I run?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 I'm installing a new pfSense router at our headquarters to properly isolate our web servers and smart office devices from the main employee network. Please provide the configuration workflow. Output the final plan as a markdown report titled 'pfSense Firewall Configuration Report'. Below the title, list the device, interfaces, VLANs, and total rule count. Next, insert a table summarizing the rules per interface (including pass, block, and logging columns). Finally, add a bulleted list of the security controls like IDS, VPN, and logging.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 We want to implement automated IP reputation and malware domain blocking on our firewall. What package should be installed and what feeds are recommended?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-09 I need to allow the Corporate LAN to access the internet, but I want to ensure they cannot route to other internal VLANs using this rule. How should the destination be configured?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Which specific firewall rules should have logging explicitly enabled to ensure proper security monitoring without overwhelming the logs?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 We need external SSH access to an internal jump host (10.10.20.11), but we want to use port 2222 on the outside. How do we set up this NAT rule?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 When configuring the DNS Resolver for the internal networks on our edge router, what security feature should be enabled to validate DNS responses?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 Our DMZ servers need to send outbound traffic, but we want them to use a dedicated public IP rather than the primary WAN IP. How is this configured in the firewall?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Configuring the Guest VLAN (VLAN 30) for our office router. What should the DHCP server hand out for DNS, and how should the DNS Resolver be configured for this zone?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-21 On the LAN interface, we want to allow internet access but explicitly block access to the IoT network. How should these rules be ordered?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 I need to set up a pfSense firewall for my startup's new office. We have a WAN, LAN, DMZ, and a guest network. Can you give me the configuration steps? Please format the output as a configuration report with a main level-2 heading, followed by device/interface/VLAN/rule count stats, a table summarizing the pass/block rules and logging status for each interface, and a bulleted list of security controls at the end.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We are deploying a Netgate appliance to segment our manufacturing floor from the corporate network and guest Wi-Fi. Walk me through the pfSense setup for these zones. Your response must be structured as a configuration report starting with a level 2 heading. Include metadata for the device, interfaces, VLANs, and total rules. Then, provide a rule summary table broken down by interface with columns for pass rules, block rules, and logging. Finish with a section detailing the active security controls.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +41 percentage points is the difference between those two pass rates over the 21 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 13.6%
Pass rate with the skill: 54.6%
Cases attempted: 22
Cases counted toward lift: 21
Cases that regressed: 2
Skill version measured: v1
Run completed: 7/28/2026, 15:37 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run55

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+97% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.