Features
http://www.pfsense.org
pfSense includes most all the features in expensive commercial firewalls, and more in many cases. The following is a list of features currently available in the pfSense 1.2 release. All of these things are possible in the web interface, without touching anything at the command line.
In addition to features, this page also includes all limitations of the system of which we are aware. From our experience and the contributed experiences of thousands of our users, we understand very well what the software can and cannot do. Every software package has limitations. Where we differ from most is we clearly communicate them. We also welcome people to contribute to help eliminate these limitations. Many of the listed limitations are common to numerous open source and commercial firewalls. 1.2 limitations already fixed in the code that will become the next major release will be noted.
Firewall
http://www.pfsense.org
pfSense includes most all the features in expensive commercial firewalls, and more in many cases. The following is a list of features currently available in the pfSense 1.2 release. All of these things are possible in the web interface, without touching anything at the command line.
In addition to features, this page also includes all limitations of the system of which we are aware. From our experience and the contributed experiences of thousands of our users, we understand very well what the software can and cannot do. Every software package has limitations. Where we differ from most is we clearly communicate them. We also welcome people to contribute to help eliminate these limitations. Many of the listed limitations are common to numerous open source and commercial firewalls. 1.2 limitations already fixed in the code that will become the next major release will be noted.
Firewall
- Filtering by source and destination IP, IP protocol, source and destination port for TCP and UDP traffic
- Able to limit simultaneous connections on a per-rule basis
- pfSense utilizes p0f, an advanced passive OS/network fingerprinting utility to allow you to filter by the Operating System initiating the connection. Want to allow FreeBSD and Linux machines to the Internet, but block Windows machines? pfSense can do so (amongst many other possibilities) by passively detecting the Operating System in use.
- Option to log or not log traffic matching each rule.
- Highly flexible policy routing possible by selecting gateway on a per-rule basis (for load balancing, failover, multiple WAN, etc.)
- Aliases allow grouping and naming of IPs, networks and ports. This helps keep your firewall ruleset clean and easy to understand, especially in environments with multiple public IPs and numerous servers.
- Transparent layer 2 firewalling capable - can bridge interfaces and filter traffic between them, even allowing for an IP-less firewall (though you probably want an IP for management purposes).
- Packet normalization - Description from the pf scrub documentation - "'Scrubbing' is the normalization of packets so there are no ambiguities in interpretation by the ultimate destination of the packet. The scrub directive also reassembles fragmented packets, protecting some operating systems from some forms of attack, and drops TCP packets that have invalid flag combinations."
- Enabled in pfSense by default
- Can disable if necessary. This option causes problems for some NFS implementations, but is safe and should be left enabled on most installations.
- Disable filter - you can turn off the firewall filter entirely if you wish to turn pfSense into a pure router.
Click Here to Download
- File:pfSense-1.2.2-Embedded.img.gz
- File:pfSense-1.2.2-Embedded.img.gz.md5
- File:pfSense-1.2.2-LiveCD-Installer.iso
- File:pfSense-1.2.2-LiveCD-Installer.iso.md5
- File:pfSense-1.2.3-RC1-Embedded.img.gz
- File:pfSense-1.2.3-RC1-Embedded.img.gz.md5
- File:pfSense-1.2.3-RC1-LiveCD-Installer.iso
- File:pfSense-1.2.3-RC1-LiveCD-Installer.iso.md5
- File:pfSense-Developers-1.2.2.iso.gz
- File:pfSense-Developers-1.2.2.iso.gz.md5
