CIS pfSense Benchmark

This recommendation verifies that pfSense is running the latest stable version on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check pfSense version (SSH or console):
uname -a
cat /etc/version

# Via PHP shell:
php -r "require_once('globals.inc'); echo g_get('product_version');"

# Update pfSense:
pfSsh.php playback upgrade

# Or via WebGUI:
# System > Update > Check for updates
# Install available update

This recommendation verifies that only necessary packages are installed on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check installed packages:
pkg info | grep pfSense-pkg

# Via PHP:
php -r "require_once('pkg-utils.inc'); print_r(get_pkg_info('installed_only'));"

# Remove unnecessary packages:
pkg delete pfSense-pkg-<name>

# Or via WebGUI:
# System > Package Manager > Installed Packages
# Remove packages not in use

This recommendation verifies that default admin credentials are changed on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check admin account configuration:
grep -c '<admin>' /conf/config.xml

# List all users:
php -r "
require_once('auth.inc');
\$config = parse_config(true);
foreach(\$config['system']['user'] as \$u) {
  echo \$u['name'] . ' - ' . \$u['scope'] . PHP_EOL;
}
"

# Change default admin password via CLI:
php -r "
require_once('auth.inc');
local_user_set_password(\$config['system']['user'][0], 'N3wS3cur3P@ss!');
write_config('Password updated');
"

# Create non-default admin account via WebGUI:
# System > User Manager > Add user with admin privileges
# Then disable or rename default 'admin'

This recommendation verifies that external authentication is configured on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check authentication servers:
grep -A5 '<authserver>' /conf/config.xml | head -20

# Check LDAP/RADIUS config:
php -r "
require_once('auth.inc');
foreach(\$config['system']['authserver'] ?? [] as \$s) {
  echo \$s['name'] . ': ' . \$s['type'] . PHP_EOL;
}
"

# Configure LDAP authentication via WebGUI:
# System > User Manager > Authentication Servers > Add
# Type: LDAP
# Hostname: ldap.company.com
# Transport: SSL/TLS
# Search scope: Entire Subtree
# Base DN: DC=company,DC=com

# Set as primary auth:
# System > User Manager > Settings
# Authentication Server: LDAP-Server

This recommendation verifies that HTTPS-only access with custom certificate on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check WebGUI protocol:
grep '<webgui>' /conf/config.xml -A10 | grep protocol

# Check TLS cert:
openssl s_client -connect 127.0.0.1:443 -brief 2>/dev/null | head -5

# Check listening ports:
sockstat -4 -l | grep -E 'nginx|php'

# Configure HTTPS-only WebGUI:
# System > Advanced > Admin Access
# Protocol: HTTPS
# SSL/TLS Certificate: Use ACME or custom CA cert
# TCP port: 8443 (non-default)
# WebGUI redirect: Disable HTTP redirect

# Via config.xml:
# <protocol>https</protocol>
# <port>8443</port>

This recommendation verifies that HSTS and security headers are enabled on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check HSTS and security headers:
fetch -qo - https://127.0.0.1/diag_command.php 2>/dev/null | head -20

# Check NGINX config for headers:
grep -E 'Strict-Transport|X-Frame|X-Content' /var/etc/nginx-webConfigurator*.conf 2>/dev/null

# Enable HSTS in Advanced Admin:
# System > Advanced > Admin Access
# HTTP Strict Transport Security: Enable

# Add custom security headers via System Tunables or
# System > Advanced > Admin Access > Browser security headers

This recommendation verifies that login brute-force protection is configured on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check login protection / anti-brute-force:
grep '<webgui>' /conf/config.xml -A20 | grep -E 'lockout|loginban'

# Check sshlockout:
ps aux | grep sshlockout

# Configure login protection:
# System > Advanced > Admin Access > Login Protection
# Threshold: 5 failed attempts
# Blockout Time: 1800 seconds
# Detection Time: 300 seconds
# Whitelist: management subnet only

# Ensure sshlockout is running:
/usr/local/sbin/sshlockout_pf &

This recommendation verifies that WAN default deny and bogon blocking are enabled on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check firewall rules:
pfctl -sr

# Check rules per interface:
pfctl -sr | head -40

# Check rule count:
pfctl -si | grep -E 'current entries|searches'

# Ensure WAN default deny:
# Firewall > Rules > WAN
# Default: Block all inbound
# Add specific allow rules as needed

# Ensure bogon/RFC1918 blocking on WAN:
# Interfaces > WAN
# Block private networks: checked
# Block bogon networks: checked

This recommendation verifies that anti-spoofing is enabled on internal interfaces on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check anti-spoofing (uRPF):
pfctl -sr | grep 'antispoof'

# Check interface anti-spoof settings:
grep 'antispoof' /tmp/rules.debug

# Enable anti-spoofing:
# System > Advanced > Firewall & NAT
# Antispoof: Enable on all internal interfaces

# Via config:
# Ensure antispoof rules are generated for internal interfaces

This recommendation verifies that firewall logging is configured on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check logging settings:
grep 'logdefaultblock\|logdefaultpass' /conf/config.xml

# Check pflog interface:
ifconfig pflog0
tcpdump -i pflog0 -c 5 2>/dev/null

# Enable logging on default block rules:
# Status > System Logs > Settings
# Log packets matched from the default block rule: checked
# Log packets matched from the default pass rule: unchecked

# Configure remote syslog:
# Status > System Logs > Settings > Remote Logging Options
# Remote log servers: 10.1.1.200
# Remote Syslog Contents: Firewall Events

This recommendation verifies that OpenVPN uses strong encryption and tls-crypt on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check OpenVPN server configuration:
grep -A30 '<openvpn-server>' /conf/config.xml | head -40

# Check running VPN tunnels:
ps aux | grep openvpn
sockstat -4 -l | grep openvpn

# Harden OpenVPN configuration via WebGUI:
# VPN > OpenVPN > Servers > Edit
# TLS Configuration: Use a TLS Key (tls-crypt)
# Peer Certificate Authority: Custom CA
# DH Parameter Length: 4096
# Encryption Algorithm: AES-256-GCM
# Auth Digest Algorithm: SHA512
# Certificate Depth: One (Client+Server)

This recommendation verifies that IPsec uses IKEv2 with strong algorithms on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check IPsec configuration:
ipsec statusall

# Check phase 1 proposals:
grep -A20 '<phase1>' /conf/config.xml | grep -E 'encryption|hash|dhgroup'

# Harden IPsec Phase 1:
# VPN > IPsec > Tunnels > Edit Phase 1
# Key Exchange: IKEv2
# Encryption Algorithm: AES-256-GCM
# Hash Algorithm: SHA256
# DH Group: 14 (2048 bit) minimum, prefer 20/21
# Lifetime: 28800

# Phase 2:
# Encryption: AES-256-GCM
# Hash: SHA256
# PFS key group: 14 minimum

This recommendation verifies that DNS over TLS and DNSSEC are enabled on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DNS resolver settings:
grep -A10 '<unbound>' /conf/config.xml | head -15

# Check if DNS over TLS is configured:
grep 'forward-tls-upstream' /var/unbound/unbound.conf

# Check DNSSEC:
grep 'module-config\|val-permissive' /var/unbound/unbound.conf

# Configure DNS over TLS:
# Services > DNS Resolver > General
# Enable DNSSEC: checked
# DNS Query Forwarding: Enable
# Use SSL/TLS for DNS Queries: checked

# Add upstream DNS over TLS servers:
# Services > DNS Resolver > General > DNS over TLS
# 1.1.1.1@853#cloudflare-dns.com
# 8.8.8.8@853#dns.google

This recommendation verifies that SSH is hardened or disabled on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SSH access:
sockstat -4 -l | grep sshd
grep '<enablesshd>' /conf/config.xml

# Check SSH configuration:
grep -E 'PermitRootLogin|PasswordAuth' /etc/ssh/sshd_config

# Harden SSH:
# System > Advanced > Admin Access > Secure Shell
# Enable: Only if necessary
# SSHd Key Only: Public Key Only
# Allow Agent Forwarding: unchecked
# SSH Port: 2222 (non-default)

# Restrict SSH to management IP:
# Firewall > Rules > add rule allowing SSH from mgmt subnet only

This recommendation verifies that security-related sysctl tunables are set on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check system tunables:
sysctl net.inet.tcp.blackhole
sysctl net.inet.udp.blackhole
sysctl net.inet.icmp.drop_redirect
sysctl net.inet6.icmp6.rediraccept

# Set security-related sysctls:
# System > Advanced > System Tunables
# net.inet.tcp.blackhole = 2
# net.inet.udp.blackhole = 1
# net.inet.icmp.drop_redirect = 1
# net.inet6.icmp6.rediraccept = 0
# net.inet.tcp.path_mtu_discovery = 0
# security.bsd.see_other_uids = 0

This recommendation verifies that NTP is configured on the pfSense firewall/router. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the pfSense firewall/router vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check NTP configuration:
grep '<timeservers>' /conf/config.xml
ntpq -p 2>/dev/null

# Check NTP daemon:
ps aux | grep ntpd

# Configure NTP:
# Services > NTP > Settings
# NTP Servers: 0.pool.ntp.org, 1.pool.ntp.org
# Interface: LAN / Management only
# Orphan Mode: 12
# Enable NTP Server for LAN clients