Skip to content
pfCentral

Tutorial 3: Make your first change

In this tutorial you let a monitoring server poll the firewall over SNMP. You create an alias for the monitoring host, a firewall rule that uses it, and apply both. Then you undo the change. It takes about 10 minutes.

You will learn:

  • how the device pages map to the pfSense GUI you know;
  • the difference between Save and Apply;
  • how to check a change on the firewall.

You need: the firewall from Tutorial 2, online, and an account with the operator role or higher.

1. Create an alias

Section titled “1. Create an alias”

An alias is a named list of addresses or ports. Rules that use an alias update when the alias changes.

Open the firewall from the left rail, then Firewall → Aliases.

  1. The aliases list for fw-hq-01
    Full size ↗
    Step 1 of 4 Open the aliases list

    pfCentral asks the agent for the aliases and shows them as the firewall has them. Click New Alias.

  2. New Alias side panel with Name, Type, Description and Hosts fields
    Full size ↗
    Step 2 of 4 The alias form

    The form has the same fields as Firewall → Aliases → Add in pfSense: a name, a type (Host, Network, Port, URL…) and the entries.

  3. New Alias form filled with Monitoring_Hosts, type Host, address 10.10.0.20
    Full size ↗
    Step 3 of 4 Fill it in

    Name: Monitoring_Hosts. Type: Host. Description: SNMP pollers. Host: 10.10.0.20, description zabbix01. Click Save.

  4. Aliases list with the new Monitoring_Hosts alias and the Apply Aliases button
    Full size ↗
    Step 4 of 4 Saved, not yet applied

    The alias is in the firewall's configuration. Click Apply Aliases on the rules page (next step) to load it into the running firewall.

fig. — create an alias

2. Create the rule

Section titled “2. Create the rule”

Open Firewall → Rules and click New Rule.

  1. New Firewall Rule panel: pass, lan, IPv4, UDP, source Monitoring_Hosts, destination lanip port 161
    Full size ↗
    Step 1 of 2 Fill in the rule

    Action Pass. Interface lan. Protocol UDP. Source Monitoring_Hosts. Destination lanip, port 161. Description SNMP from monitoring. Click Save.

  2. Rules list with the new SNMP rule and the Apply Rules button
    Full size ↗
    Step 2 of 2 Apply

    The rule appears in the list. Click Apply Rules. The agent runs pfSense's own filter reload, exactly like Apply Changes in the pfSense GUI, and reports success or the error.

fig. — create a rule

What just happened

Section titled “What just happened”
You ── Save ──▶ pfCentral ── pfsense.<uuid>.firewall.rules.create ──▶ agent ──▶ config.xml
You ── Apply ─▶ pfCentral ── pfsense.<uuid>.firewall.rules.apply  ──▶ agent ──▶ filter reload

Each click is one request over the agent’s open connection. pfCentral checked your role first: a viewer gets “Not permitted” and nothing reaches the firewall.

3. Check it on the firewall

Section titled “3. Check it on the firewall”

Open the pfSense GUI (the Open WebUI button on the device page links to it) and go to Firewall → Rules → LAN. The rule is there with your description. Firewall → Aliases lists Monitoring_Hosts.

You can also check from pfCentral: Diagnostics → Tables shows the Monitoring_Hosts pf table with 10.10.0.20 once the aliases are applied.

4. Undo the change

Section titled “4. Undo the change”
  1. In Firewall → Rules, delete the SNMP from monitoring rule and confirm. Click Apply Rules.
  2. In Firewall → Aliases, delete Monitoring_Hosts and confirm.

Always delete the rule before the alias. pfCentral does not stop you from deleting an alias that a rule still uses, and pfSense cannot load a rule that names a missing alias.

What you learned

Section titled “What you learned”
  • Device pages mirror the pfSense GUI. Lists come live from the firewall.
  • Save writes the configuration; Apply makes the firewall use it.
  • Every change is a request to one firewall, checked against your role.

Next: Tutorial 4: Bring in your team.