Install pfSense from USB – The Ultimate Guide

To install pfSense from USB, download the free Netgate Installer (AMD64 Memstick) from the Netgate Store, write it to a USB drive with balenaEtcher and boot your firewall from it. Connect a console at 115200 baud and run the installer, which needs internet on the WAN port. The current pfSense CE release is 2.9.0.

Short version

1. Get the Netgate Installer (AMD64 Memstick) from the Netgate Store. It is free, the checkout only delivers the download.
2. Write the image to a USB drive with balenaEtcher. Etcher reads the compressed .gz file directly.
3. Connect a serial cable (PuTTY: Serial, 115200) or a monitor and keyboard, plug in the USB drive and boot from it.
4. In the installer, accept the license, choose Install, set up WAN and LAN, pick ZFS, confirm the disk and the software version.
5. Reboot, remove the USB drive and open https://192.168.1.1 with admin / pfsense.

With this article, we intend to provide a complete and beginner-friendly guide on how to install pfSense from USB on a physical appliance. This is one of the most difficult things to do when it comes to installing pfSense, so we walk you through the whole process in a step-by-step fashion. Should you need a more complete, video-guided introduction to pfSense, we can highly recommend the Complete pfSense Fundamentals Bootcamp, where we cover all of the steps below and much more.

Summary: In this article, you will learn how to install pfSense from USB using a Serial Cable (Null Modem Cable).

Table of Contents

• Short version
• Requirements
• What is pfSense?
• What Hardware do I need to Install pfSense?
• pfSense Minimum Hardware Requirements
• What are the Steps to Install and Configure pfSense?
• Step 1 - Downloading the pfSense Image
• Step 2 - Creating a bootable USB drive
• Step 3 - Setting up the connection to pfSense
• Step 4 - Connecting to pfSense using puTTY
• Step 5 - Booting pfSense from USB
• BIOS Setup
• Step 6 - Install pfSense from USB
• Step 7 - Configuring pfSense via Web GUI
• WebGUI Setup 1
• WebGUI Setup 2
• WebGUI Setup 3
• WebGUI Setup 4
• WebGUI Setup 5
• WebGUI Setup 6
• WebGUI Setup 7
• WebGUI Setup 9
• Step 8 - Wrapping Up
• FAQ
• Do I need an internet connection to install pfSense from USB?
• What serial console settings does pfSense use?
• Why does my USB drive look broken after I wrote the pfSense image?
• Is pfSense free?
• Can I run pfSense in a VM or on a Raspberry Pi?
• Conclusion

Requirements

• Download & Install puTTY
• Download & Install balenaEtcher, the tool Netgate recommends for writing the image
• A free Netgate Store account to download the installer
• USB Drive with 2GB free space

What is pfSense?

PfSense is an open-source firewall and router platform that offers a wide range of powerful features and customization options. Designed to be easy to install, configure, and manage, regardless of your skill level, pfSense makes it simple to protect your network against security threats, reduce latency, and increase efficiency.

Whether you’re running a small home office or managing a large enterprise network, pfSense has the capabilities you need to keep your data safe and your network running smoothly. With its intuitive interface and robust feature set, pfSense is the perfect solution for any organization seeking enhanced security and greater control over its digital infrastructure.

While pfSense is heavily used in the corporate world, it also is a popular solution for small businesses or home networks. pfSense is a great first firewall to set up in your home network if you want to learn more about how to secure your data and how to manage your network since it’s so easy to use.

What Hardware do I need to Install pfSense?

To install pfSense, you will need certain hardware components and peripherals. For example, you will need a computer with at least 1 GB of RAM and a minimum of 8 GB of disk space for the operating system. In addition, you will need an Ethernet interface to connect your computer to your network.

Other essential components and peripherals include a firewall-capable router, network cables or a wireless adapter, and any required power supplies or adapters. Overall, the specific hardware requirements vary depending on your needs and preferred setup, but having the right tools is key to successfully installing pfSense on your network.

For boxes that run pfSense well, see pfSense hardware guide.

pfSense Minimum Hardware Requirements

The absolute minimum requirements to install pfSense are:

• A 64-bit amd64 (x86-64) compatible CPU.
• 1 GB of RAM.
• 8 GB of free Hard Disk Space.
• At least one compatible network interface (1 interface isn’t very practical).
• A bootable USB Drive with at least 1GB of space.

These match the minimum requirements in the Netgate docs for hardware not sold by Netgate. They are not enough for every environment.

What are the Steps to Install and Configure pfSense?

To install pfSense on a physical appliance, we have to follow through quite a few steps. A quick summary of these steps is as follows:

• Downloading the pfSense image & creating a bootable USB drive.
• Setting up the connection to pfSense & connecting to pfSense with puTTy
• Booting pfSense from USB & installing pfSense on the device
• Configuring pfSense via Web GUI

Step 1 - Downloading the pfSense Image

We use a Serial Connection to connect to our pfSense Firewall. The USB (memstick) image supports both serial and VGA consoles. If your firewall has a VGA output and you want to use a monitor to install it, you simply pick the matching console type when the installer starts.

pfSense CE is now installed with the Netgate Installer, which you get from the Netgate Store. Sign in to your store account, open the Netgate Installer product, choose AMD64 Memstick (USB), add it to your cart and check out. The installer is free, the checkout only delivers the download link. The AMD64 ISO option is meant for virtual machines, IPMI and optical drives.

The screenshot below shows the old pfsense.org download page. That page no longer offers a direct download, so follow the Netgate Store steps above instead.

Netgate publishes a SHA-256 hash for the compressed file, so you can check the download before you use it. The image is compressed (.gz). balenaEtcher can write it as it is. If you use another tool, navigate to your Downloads folder, right-click the file and use 7-zip to extract it first.

Step 2 - Creating a bootable USB drive

To be able to install pfSense from USB, we need to create a bootable USB drive. 2GB USB Drive is sufficient.

Next, start balenaEtcher, click Flash from file and select the downloaded installer image. Click Select target, choose your USB drive and click Flash!. Double-check the target, because everything on your USB drive will be deleted.

The screenshot below shows Win32DiskImager, which I used originally. It does the same job: pick the USB drive under Device, choose the image file and hit Write. The Netgate docs now recommend Etcher.

Step 3 - Setting up the connection to pfSense

We have a built-in serial converter in our appliance, so we can use a USB cable to connect our PC to our pfSense firewall. You most likely will only have a serial cable. Whatever you have, connect pfSense to your PC now with whatever type of serial cable you have.

Also, go ahead and plug the USB drive into the USB slot of your pfSense appliance.

Make sure your pfSense appliance is running now.

Next, hit the Windows Key and type “Device Manager” into the search field. Open the Device Manager.

Because this converter is built into our firewall, we have to install a driver for it. If you use any kind of USB to Serial cable with a built-in converter, you probably also have to install a driver. Gladly, it’s very simple:

Right-click the USB-Serial Controller in your Device Manager and select Update Driver.

Select “Search automatically for updated driver software”.

For our converter, that worked perfectly. It finds the driver and installs it. Your experience may vary. Look up which type of USB to Serial Converter is built into your cable and search for that specific driver on Google and install it manually if Windows Update doesn’t find it. We had a good experience using the “Prolific USB-to-Serial” type converters.

You will find the installed device under Ports (COM & LPT) now.

Now, this is very important. You have to remember the COM Port that your device got assigned. In our case, it’s COM3, as shown in the screenshot above.

If you use any other Serial Connection, make sure that you know which COM port it is using. That is important for the connection with puTTY. If you don’t know, simply go through all of your COM ports when trying to connect with puTTY, and one will be working.

Good, now that we got that figured out, we can try to connect with puTTY.

⚠️ If you would like to learn more about pfSense, I highly recommend you check out my pfSense Fundamentals Bootcamp over at Udemy. This is the most up-to-date as well as the highest-rated pfSense course on Udemy.

Step 4 - Connecting to pfSense using puTTY

Open PuTTY. Don’t get thrown off by how many options there are.

Set the Connection Type to Serial. For Serial Line, enter your COM port. For Speed, choose 115200. The speed might vary depending on your appliance. In case, look up your appliance documentation. The default values for be pfSense can be found here: https://docs.netgate.com/pfsense/en/latest/hardware/connecting-to-the-serial-console.html

Now type “pfSense” underneath of “Saved Sessions” and hit the Save button on the right. This way, you can reconnect to your pfSense firewall without typing everything again each time you want to connect.

Finally, click on Open. Hit the Enter key once the window opens. You should now see something popping up, which leads us to our next step.

Step 5 - Booting pfSense from USB

First, we need to make sure to be able to boot via a USB drive. Because you already placed your USB drive in your firewall, it’s possible that you are already in the pfSense installer menu. If that’s the case, you can skip the following BIOS step and wait until we get to the installation.

BIOS Setup

Restart your firewall and get into the BIOS. This probably varies from appliance to appliance. We have to press either TAB or DEL when it’s booting up. Look up your appliance’s documentation in case you can’t figure it out. Usually, it’s written there which button to press when you start it.

Leave your puTTY window open, and restart the appliance either by pressing a button or just pulling the power cable.

If you do not want to go into the BIOS, try the one-time boot menu first. It is commonly opened with Esc or F12 while the appliance boots.

Once you are in the BIOS, navigate to Boot. On our appliance, the Boot mode has to be on LEGACY. Whether you need Legacy or UEFI depends on your hardware, so check your appliance documentation. Make sure your USB Drive is on #1 as a Boot Option, and your Hard Drive is on #2.

Navigate to Save & Exit and select Save Changes and Reset. Your firewall will reboot again.

Step 6 - Install pfSense from USB

Now, if you did everything correctly, your appliance should boot from the USB drive. We will guide you through the whole installation process now.

A note before we start: the screenshots in this step show the older pfSense installer. The current Netgate Installer looks similar but works a bit differently. In short, it does this:

1. Asks for the console type (serial) and the license.
2. Shows the Welcome menu where you choose Install.
3. Asks you to configure the WAN interface (DHCP, static IP or PPPoE) and then the LAN interface. This replaces the automatic interface assignment you see in the old screenshots.
4. Runs an eligibility check for pfSense Plus. If your device is not eligible, you can install pfSense CE instead.
5. Asks for the file system (ZFS is the default and recommended) and the partition scheme (GPT is the default on most modern AMD64 devices).
6. Asks for a final confirmation, which destroys existing data on the target disk, and lets you pick the software version (the Current Stable Version is the normal choice).

Because the Netgate Installer is an online installer, the WAN port needs a working internet connection during the installation. It downloads pfSense from Netgate’s servers.

For Console Type, type xterm and hit enter. Netgate recommends xterm for modern clients, and vt100 as the most compatible fallback:

Accept the Copyright and distribution notice.

Select Install pfSense:

Choose your preferred keymap by scrolling down, selecting the one you want and pressing enter. Select “Continue with YourKeymap” on the top and hit enter. Repeat the same in the next step.

For partitioning, that’s up to your personal preference, but we will choose the new Auto (ZFS) Filesystem that was introduced with pfSense 2.4. If you don’t know what to choose, I recommend ZFS for you as well.

Select Pool Type/Disks and hit Enter. Choose Stripe - No Redundancy. Make sure you select your appliance’s hard drive in the next window by pressing Space Bar and hitting Enter.

Make sure Partition Scheme is set to GPT (BIOS) and leave everything else as default. Finally, select Install on top of the screen and hit enter.

Agree and be aware that everything on your Hard Drive will get wiped.

For the question, if you want to do some manual configuration steps, choose no.

Now select Reboot and get ready to enter that BIOS Menu again while the appliance is rebooting. We need to change the boot order back to the correct order. Remove your USB drive from the appliance after it reboots.

Navigate to Save & Exit and select Save Changes and Reset.

If all went well, you would now end up in the pfSense Welcome Screen.

You can see that the interfaces were assigned. In the old installer, the first interface automatically became WAN and the second one became LAN. With the Netgate Installer, you choose them yourself during the network setup.

By default, WAN gets its address via DHCP, and the LAN has the static IP 192.168.1.1/24.

Step 7 - Configuring pfSense via Web GUI

Connect a LAN cable to the LAN port on your firewall. Usually, the first port is dedicated to WAN(igb0), and the second port is dedicated to LAN(igb1). Connect your Laptop / PC / Switch to the other end of the LAN port.

The WAN interface is the one where you want to plug your Modem / Internet Connection in. If you don’t know which modem to use, I highly recommend the DrayTek Vigor 130. Here’s a guide on how to configure a DrayTek Modem for use with pfSense. We run multiple of those, and they served us very well over the years.

Open a Web Browser and enter the IP of your pfSense, https://192.168.1.1. The web GUI uses HTTPS, so your browser shows a certificate warning. If you want to get rid of that warning message, we got you covered.

Log in with the default credentials:

• Username: admin
• Password: pfsense

Those are the factory defaults, so change the password as soon as possible. On pfSense Plus 24.03 and later, you are even forced to set a new one at first login.

Click Next on the first dialogue.

WebGUI Setup 1

Click Next on the Netgate support dialogue.

WebGUI Setup 2

Choose a Hostname and a Domain. If you don’t have a Domain, leave it as localdomain. Click Next.

WebGUI Setup 3

Choose your Timezone, and leave the Time server hostname as default. Click Next.

WebGUI Setup 4

Now, to configure your WAN Interface, it depends on how you connect to the internet. Here in Europe, we mostly use PPPoE, and we need to enter the credentials provided by our ISP. If you already have a working internet connection and just want to connect pfSense to that, use DHCP. Look up your Internet Provider’s information, or ask in the Netgate forums.

If you choose PPPoE, scroll down until you find the PPPoE configuration and enter the details provided by your ISP.

Everything else stays on default. Scroll to the bottom and click on Next.

WebGUI Setup 5

You can either change the LAN IP Address or leave it on default. If you don’t know what that means, just leave it as it is.

WebGUI Setup 6

Change the default admin password and choose a safe password.

WebGUI Setup 7

Click on Reload.

WebGUI Setup 9

Click Finish.

Step 8 - Wrapping Up

Congratulations! If you made it this far, you successfully installed pfSense via USB / Serial Cable!

As the last step, let’s set up the temperature sensor to display the correct values. In the pfSense Web GUI, navigate to System / Advanced / Miscellaneous.

Scroll down until you find Cryptographic & Thermal Hardware. For Thermal sensors, choose either Intel or AMD, depending on which processor type you have.

Scroll down all the way to the bottom and hit Save. Now your Thermal Sensor should display the correct value.

And finally, as promised, to repair your USB Drive after the installation, follow our guide to repair a USB drive on Windows 10. Your USB drive will now have multiple partitions, rendering it unusable. We use Rufus to fix that.

FAQ

Do I need an internet connection to install pfSense from USB?

Yes. The Netgate Installer image does not contain the pfSense packages, it downloads them from Netgate’s servers during the installation. Connect the WAN port to a working internet connection before you start. The installer supports DHCP, static IP and PPPoE on the WAN.

What serial console settings does pfSense use?

pfSense uses 115200 baud, 8 data bits, no parity, 1 stop bit (115200/8/N/1). Many terminal programs default to 9600, so change the speed in PuTTY. The Netgate docs also advise against HyperTerminal, as it can lose data.

Why does my USB drive look broken after I wrote the pfSense image?

The image creates partitions that Windows, macOS and most other systems cannot read. Ignore any prompt to format the drive, because formatting destroys the installer. To reuse the stick, wipe and repartition it as described in our USB repair guide.

Is pfSense free?

pfSense CE is free. The Netgate Installer is free as well, the store checkout only delivers the download link. During the installation, the installer checks if your device is eligible for pfSense Plus. If it is not, you can install pfSense CE instead.

Can I run pfSense in a VM or on a Raspberry Pi?

A VM works fine. Use the ISO from the Netgate Installer page, and have a look at our guide to install pfSense on VirtualBox. A Raspberry Pi does not meet the requirements for hardware not sold by Netgate, which list a 64-bit amd64 (x86-64) CPU. Netgate’s own ARM devices use a separate AARCH64 image.

Conclusion

It can be a struggle to install something like pfSense via Serial Cable if you do it for the first time. That’s why we thought it might be a good idea to go through each and every step in detail. We hope you were able to install pfSense from USB and establish an internet connection. pfSense is a fantastic open-source firewall that teaches you a ton of things when you use it in your home network.

If you want to learn more about pfSense and deepen your knowledge, check out the pfSense Fundamentals Bootcamp or continue with some of the related articles below.

👀 This Tutorial has some related Articles!
👉 The Complete pfSense Fundamentals Bootcamp 👉 Install pfSense from USB - The Complete Guide 👉 Install pfSense on VirtualBox 👉 The Complete pfSense OpenVPN Guide 👉 The Complete pfSense DMZ Guide 👉 Generate SSL Certificates for HTTPS with pfSense 👉 The Complete pfSense Squid Proxy Guide (with ClamAV!) 👉 pfSense Site-to-Site VPN Guide 👉 pfSense Domain Overrides Made Easy 👉 pfSense Strict NAT (PS4,PS5,Xbox,PC) Solution 👉 The Best pfSense Hardware 👉 Traffic Shaping VOIP with pfSense 👉 pfSense OpenVPN on Linux - Setup Guide 👉 pfSense Firewall Rule Aliases Explained 👉 Email Notifications with pfSense 👉 pfSense DNS Server Guide