Skip to content
pfCentral
Self-hosted · pfSense fleet management

Manage every firewall without opening a port.

A lightweight agent on each pfSense box dials out to your server over NATS. You get one console for the whole fleet.

Get started Read the docs
fig. 1 — connection topology
pfSense · bne pfSense · syd pfSense · mel NATS pfCentral server + UI + postgres outbound only bne syd mel outbound NATS pfCentral server + UI + postgres

The console, annotated

fig. 2 — device detail
Device detail page with the fleet rail, live vitals gauges and a per-interface traffic chart
Full size ↗

  1. Fleet rail. Every firewall with its online state and live CPU and memory.

  2. Live vitals. CPU, memory, disk and temperature streamed from the agent.

  3. Per-interface traffic. In and out, charted as it happens.

Specification

What you get

No open ports
Agents dial out to the server. Nothing new listens on the firewall, and sites behind NAT just work.
Agent-based
A FreeBSD agent exposes device operations as NATS micro services. The pfSense package sets it up from the GUI.
Multi-user RBAC
Owner, admin, operator and viewer roles, with an audit log.
One connection
Firewall rules, NAT, VPNs, DHCP, DNS, interfaces, routing, services and diagnostics.

Up and running in three steps

  1. Deploy the server

    One distroless container plus PostgreSQL. First boot generates all crypto material.

  2. Install the agent

    The pfSense package connects outbound and enrolls with a one-time bootstrap token.

  3. Manage the fleet

    Push rules, aliases and VPN tunnels with live status per device.

Ready to enroll your first firewall?

The quickstart takes about 15 minutes.

Open the quickstart →