pfSense

In addition to features, this page also includes all limitations of the system of which we are aware. From our experience and the contributed experiences of thousands of our users, we understand very well what the software can and cannot do. Every software package has limitations. Where we differ from most is we clearly communicate them. We also welcome people to contribute to help eliminate these limitations. Many of the listed limitations are common to numerous open source and commercial firewalls.

·         Able to limit simultaneous connections on a per-rule basis

·         pfSense® utilizes p0f, an advanced passive OS/network fingerprinting utility to allow you to filter by the Operating System initiating the connection.

·         Option to log or not log traffic matching each rule

·         Highly flexible policy routing possible by selecting gateway on a per-rule basis (for load balancing, failover, multiple WAN, etc.)

·         Aliases allow grouping and naming of IPs, networks and ports. This helps keep your firewall ruleset clean and easy to understand, especially in environments with multiple public IPs and numerous servers.

·         Transparent layer 2 firewalling capable – can bridge interfaces and filter traffic between them, even allowing for an IP-less firewall (though you probably want an IP for management purposes)

·         Packet normalization – Description from the pf scrub documentation. Enabled in pfSense® by default. Can disable if necessary.

·         Disable filter – you can turn off the firewall filter entirely if you wish to turn pfSense® into a pure router

Most firewalls lack the ability to finely control your state table. pfSense® has numerous features allowing granular control of your state table, thanks to the abilities of OpenBSD’s pf.

·         Adjustable state table size – there are multiple production pfSense® installations using several hundred thousand states. The default state table size varies according to the RAM installed in the system, but it can be increased on the fly to your desired size. Each state takes approximately 1 KB of RAM, so keep in mind memory usage when sizing your state table. Do not set it arbitrarily high.

·         On a per-rule basis:

o    Limit simultaneous client connections

o    Limit states per host

o    Limit new connections per second

o    Define state timeout

o    Define state type

·         State types – pfSense® offers multiple options for state handling.

o    Keep state – Works with all protocols. Default for all rules

o    Modulate state – Works only with TCP. pfSense® will generate strong Initial Sequence Numbers (ISNs) on behalf of the host

o    Synproxy state – Proxies incoming TCP connections to help protect servers from spoofed TCP SYN floods. This option includes the functionality of keep state and modulate state combined

o    None – Do not keep any state entries for this traffic. This is very rarely desirable, but is available because it can be useful under some limited circumstances

·         State table optimization options – pf offers four options for state table optimization

o    Normal – the default algorithm

o    High latency – Useful for high latency links, such as satellite connections. Expires idle connections later than normal

o    Aggressive – Expires idle connections more quickly. More efficient use of hardware resources, but can drop legitimate connections

o    Conservative – Tries to avoid dropping legitimate connections at the expense of increased memory usage and CPU utilization

·         1:1 NAT for individual IPs or entire subnets

·         Outband NAT

o    Default settings NAT all outbound traffic to the WAN IP. In multiple WAN scenarios, the default settings NAT outbound traffic to the IP of the WAN interface being used

o    Advanced Outbound NAT

·         NAT Reflection – in some configurations, NAT reflection is possible so services can be accessed by public IP from internal networks

·         CPU utilization

·         Total throughput

·         Firewall states

·         Individual throughput for all interfaces

·         Packets per second rates for all interfaces

·         WAN interface gateway(s) ping response times

·         Traffic shaper queues on systems with traffic shaping enabled

·         DynDNS

·         DHS

·         DNSexit

·         DyNS

·         EasyDNS

·         FreeDNS

·         HE.net

·         Loopia

·         Namecheap

·         No-IP

·         ODS.org

·         OpenDNS

·         ZoneEdit

·         Maximum concurrent connections – Limit the number of connections to the portal itself per client IP. This feature prevents a denial of service from client PCs sending network traffic repeatedly without authenticating or clicking through the splash page.

·         Idle timeout – Disconnect clients who are idle for more than the defined number of minutes.

·         Hard timeout – Force a disconnect of all clients after the defined number of minutes.

·         Logon pop up window – Option to pop up a window with a log off button.

·         URL Redirection – after authenticating or clicking through the captive portal, users can be forcefully redirected to the defined URL.

·         MAC filtering – by default, pfSense® filters using MAC addresses. If you have a subnet behind a router on a captive portal enabled interface, every machine behind the router will be authorized after one user is authorized. MAC filtering can be disabled for these scenarios.

·         Authentication options – There are three authentication options available

o    No authentication – This means the user just clicks through your portal page without entering credentials

o    Local user manager – A local user database can be configured and used for authentication

o    RADIUS authentication – This is the preferred authentication method for corporate environments and ISPs. It can be used to authenticate from Microsoft Active Directory and numerous other RADIUS servers

·         RADIUS capabilities

o    Forced re-authentication

o    Able to send Accounting updates

o    RADIUS MAC authentication allows captive portal to authenticate to a RADIUS server using the client’s MAC address as the user name and password

o    Allows configuration of redundant RADIUS servers

·         HTTP or HTTPS – The portal page can be configured to use either HTTP or HTTPS

·         Pass-through MAC and IP addresses – MAC and IP addresses can be white listed to bypass the portal

·         File Manager – This allows you to upload images for use in your portal pages