Security model

pfCentral has full control of every firewall it manages. Treat the server like a domain controller: put it on a protected network, limit who can sign in, and back it up. This page lists what protects each part, and the limits you should know.

Network exposure

Surface	Who needs it	Protection
Firewalls	Nobody connects in	The agent only makes outbound connections.
Server port 24222 (NATS)	Agents	Every connection is checked by the authorization callout. Turn on TLS for links you do not trust.
Server port 2808 (HTTP)	Admins, and agents once to enroll	Put an HTTPS reverse proxy in front. The server itself speaks plain HTTP.

Device identity

• A person only handles a single-use, short-lived bootstrap token. UI tokens are bound to one hardware UUID.
• Each device gets a unique connect-secret. The server stores only a peppered hash.
• On every connect, the server signs a one-hour pass that allows only pfsense.<device-id>.>. One firewall cannot read or answer another firewall’s messages.
• Deleting a device deletes its secret, so it cannot reconnect.

The full sequence is on Enrollment and identity.

People and permissions

• Four roles: viewer (read), operator (read and change configuration), admin (also devices, diagnostics that run commands or power off, and members), owner (everything). See Roles and permissions.
• The server checks the role on every page and every API call, not just in the UI. A role change takes effect on the member’s next click.
• Passwords are hashed with Argon2. Sessions are stored in PostgreSQL; they last up to 24 hours and end after 30 minutes idle.
• Personal API tokens act with the role of the person who made them.

Secrets you must protect

Secret	Where	If it leaks	If you lose it
State directory (/data/state)	Server volume	An attacker can sign NATS credentials	The server will not start; you must reinstall and re-enroll
Token pepper (PFCENTRAL_TOKEN_PEPPER_*)	Server environment	Weakens stored secret hashes	No device or API token can authenticate
Database	PostgreSQL	Account and device data; no plaintext secrets	Users, devices and history are gone
Email encryption key	Server environment	Exposes queued invite and reset links	Queued emails cannot be sent

Back them up together. See Back up and restore.

Audit trail

pfCentral writes audit events to the audit_events table in PostgreSQL for sign-ins (allowed and denied), first-run setup, invites, role and status changes, password resets, every refused request with the role and reason, device enrollment and device deletion.

Current limits

• Device configuration changes (rules, NAT, VPN and so on), reboots and diagnostic commands are not yet written to the audit log.
• There is no audit viewer in the UI yet. Query the table directly, for example SELECT created_at, action, outcome FROM audit_events ORDER BY created_at DESC LIMIT 50;.
• Changes made through pfCentral do not create an entry in pfSense’s own Diagnostics → Backup & Restore → Config History. Take a pfSense backup before large changes.

Powerful features

• Diagnostics → Command Prompt runs any shell command on the firewall as root. It needs the admin role. Give admin only to people you would give root SSH.
• Traceroute and DNS Lookup send probes or DNS queries from the firewall. Both require admin or owner in the UI and API. Arguments are validated and run without a shell; execution and output are bounded. They are not substitutes for isolating the management network: an admin can still probe internal hosts or query a chosen resolver.
• Diagnostics → Packet Capture can capture passwords and other sensitive traffic. The page, controls, status and downloads need admin or owner in both the UI and API. Captures stay in agent memory for 10 minutes after completion; protect any files you download.
• General Setup → Backup Config exports the complete saved active configuration, including passwords and private keys. It needs admin or owner in both the UI and API. The export bypasses the shared response cache and uses HTTP Cache-Control: no-store, but the downloaded XML is not encrypted or redacted. Protect it yourself. Successful exports are not audited; permission denials are.
• Package Manager can install packages and replace the agent binary from a URL. Both need admin.

Hardening checklist

• Serve the web UI only over HTTPS, and keep PFCENTRAL_COOKIE_SECURE at its default (true).
• Set PFCENTRAL_TRUSTED_ORIGINS to your public URL only.
• Turn on NATS TLS and set PFCENTRAL_NATS_TLS_HOSTS to the names agents dial.
• Set a random token pepper on day one, and never change it without keeping the old value.
• Allow port 24222 only from your firewalls’ public addresses, if you know them.
• Give most people viewer or operator. Keep owner to two people.
• Limit who can reach /metrics, /docs and /openapi.json at your proxy. They do not need a login.
• Leave PFCENTRAL_AUTHZ_ENFORCE at true.