pfSense

Purpose

The pfSense integration collects firewall rule, interface and package state from pfSense/pfSense Plus appliances using the pfSense REST API package or SNMP, supporting exposure and configuration-drift evidence for small and mid-size sites.

Requirements

• pfSense 2.6+ or pfSense Plus with the REST API package installed, or SNMP enabled
• A read-only API key or a restricted local user for API access
• Network reachability from the collector to the pfSense management interface

Permissions

• API user assigned a privilege set restricted to read-only diagnostic and status pages
• SNMP community/v3 credential for interface and system metrics where the API package is not used

Setup

1. 1
   Install the REST API package

   Install the official pfSense REST API package from System > Package Manager, if not already present.
2. 2
   Create a restricted API user

   Create a local user with a custom privilege set limited to read-only status and diagnostic pages.
3. 3
   Generate an API key

   Generate the key for that user and store it in AssurIQ's Credential Vault.
4. 4
   Add the appliance to AssurIQ

   Add the pfSense management address and API key under Integrations.
5. 5
   Verify collection

   Confirm firewall rules, interfaces and package versions populate.

Verification

• Appliance appears in Network Map with version and interface list
• Firewall rule summary and WAN exposure status populate
• Configuration backup or diff evidence is recorded

Data collected

• Firewall and NAT rule configuration
• Interface, gateway and VLAN configuration
• Installed package versions and pfSense version
• WAN-facing service exposure

Security model

The API user's privilege set is restricted to read-only status and diagnostic pages and cannot modify rules or interfaces. All access runs over HTTPS from the collector.

Common errors

• AIQ-CRD-001Credentials failing
  Stored credentials were rejected by one or more targets.

Troubleshooting

• If the REST API package is unavailable for a given release, fall back to SNMP for basic interface and system evidence.
• If WAN exposure looks incorrect, confirm the firewall rule set matches the live configuration rather than a saved-but-unapplied change.

Disconnect

1. Remove the appliance from AssurIQ Integrations.
2. Delete the restricted API user or SNMP credential from pfSense.