Introduction
pfCentral is a self-hosted console for a fleet of pfSense firewalls. You manage firewall rules, NAT, VPNs, interfaces, services and diagnostics for every firewall from one web UI or API. You do not log in to each firewall, and you do not open a port on any of them.
Who it is for
Section titled “Who it is for”- MSPs and IT teams that run pfSense at many sites: branches, shops, clients, data centres.
- Network admins who want one place to see which firewalls are online, and to make the same change on many of them.
- Security teams that cannot expose firewall web GUIs or SSH to a central network.
You do not need to know NATS, Go or Kubernetes. The docs explain each new idea when you first meet it.
What makes it different
Section titled “What makes it different”| Promise | What it means for you |
|---|---|
| No open ports | A small agent on each firewall dials out to the server. Firewalls behind NAT, CGNAT or a strict upstream router work. |
| Self-hosted | The server runs on your hardware or cloud. It works without internet access. |
| One console | Rules, aliases, NAT, VPN, DHCP, DNS, routing, packages and diagnostics for every firewall. |
| Teams and roles | Owner, admin, operator and viewer roles, enforced on every page and API call. |
| UI and API | Everything you can click, you can also script. The API explorer is built in. |
How the docs are organised
Section titled “How the docs are organised”The docs follow the order in which you meet pfCentral:
Start here The big picture and a 15-minute quickstart.
Tutorials Four guided lessons: deploy, connect a firewall, make a change, add your team.
Day 0 · Plan and deploy Size, network, TLS, Docker, Kubernetes, email.
Day 1 · Onboard Enroll firewalls at scale, set up users, automate with the API.
Day 2 · Operate Monitor, upgrade, back up, rotate secrets, troubleshoot.
Using pfCentral A guide to every area of the web UI.
Concepts NATS, enrollment and the security model, with animations.
Reference Environment variables, CLI, endpoints, subjects, permissions.
Before you start
Section titled “Before you start”You need:
- A Linux host or Kubernetes cluster that can run a container. A small VM is enough for a small fleet.
- PostgreSQL. The quickstart starts one for you (PostgreSQL 17).
- One or more firewalls on pfSense 2.7.0 or later (amd64). Each must reach the server on TCP port 24222, and on the web port once to enroll.
Ready? Read How pfCentral works for five minutes, or go straight to the Quickstart.