pfSense es una distribución personalizada de FreeBSD adaptado para su uso como Firewall y Router. Se caracteriza por ser de código abierto, puede ser instalado en una gran variedad de ordenadores, y además cuenta con una interfaz web sencilla para su configuración.









El proyecto pfSense se inició en septiembre de 2004 por Chris Buechler y Ullrich Scott como un fork de m0n0wall, enfocado a las instalaciones en PC y Servidores (al contrario de m0n0wall que se orientaba a ambientes embebidos y ordenadores de bajos recursos). Se calcula que para diciembre de 2010, pfSense contaba con más de un millón de descargas

pfSense, un sistema basado en FreeBSD para actuar como Firewall y Router. Es de código abierto y puede ser instalada en multitud de ordenadores.  Su interfaz web de configuración recuerda mucho a IPCop o m0n0wall.



PfSense puede instalarse en cualquier ordenador o servidor que cuente con un mínimo de dos tarjetas de red, el proceso de instalación es similar a FreeBSD. Una vez copiados los archivos del sistema al disco duro, se procede a configurar las direcciones IP de las tarjetas de red. Una vez concluido lo anterior, se puede acceder al sistema desde un explorador web. El portal de administración está basado en PHP y teóricamente todas las configuraciones y administración se pueden realizar desde allí, por lo tanto no es indispensable contar con conocimientos avanzados sobre la línea de comandos UNIX para su manejo.

El cortafuegos forma parte del Kernel del sistema, de hecho, se trata de Packet Filter (PF) originario de OpenBSD, considerado como el sistema operativo más seguro del mundo.




Packet Filter (PF) está presente como estándar en FreeBSD desde noviembre de 2004, incluye funcionalidades como el regulador de caudal Alternate Queuing, más conocido como ALTQ. Un conjunto de herramientas de calidad de servicio (QoS) que permiten montar colas de tráfico, asignando caudales y prioridades. ALTQ dispone de distintos modelos de funcionamiento.

pfSense emplea colas HFSC (Hierarchical Fair Service Curve) con funcionalidades ACK, RED (Random Early Detection) y ECN (Explicit Congestion Notification).

Características de PFSense

 La siguiente lista muestra algunas funcionalidades que se incluyen por defecto en el sistema.

• Firewall
• State Table
• Network Address Translation (NAT)
• Balanceo de carga
• VPN que puede ser desarrollado en IPsec, OpenVPN y en PPTP
• Servidor PPPoE
• Servidor DNS
• Portal Cautivo (Captive Portal – Wi-Fi Hotspot)
• Servidor DHCP
• Soporte Ipv4 y Ipv6
• Gráficos RRD
•  Multi-Wan

PfSense cuenta con un gestor de paquetes para ampliar sus funcionalidades, al elegir el paquete deseado el sistema automáticamente lo descarga e instala. Existen alrededor de setenta módulos disponibles, entre los que se encuentran el proxy Squid, IMSpector, Snort, ClamAV, entre otros.

Paquete disponibles

Seguridad

• arpwatch - Arpwatch monitors Ethernet to IP address pairings and logs changes to syslog.
• Ipguard-dev - Attempts to maintain IP:MAC pairs by force.
• nmap - A utility for network exploration or security auditing.
• OpenVPN Client Export Utility - Allows a pre-configured OpenVPN Windows Client or Mac OSX's Viscosity configuration bundle to be exported directly from pfSense.
• snort - An open source network intrusion prevention and detection system (IDS/IPS).
• SSHDCond - Defines SSH overrides for users,groups,hosts and addresses using Match in a convenient way.
• stunnel - An SSL encryption wrapper between remote client and local or remote servers.
• sudo - Allows delegation of privileges to users in the shell so commands can be run as other users, such as root.
• suricata - High Performance Network IDS, IPS and Security Monitoring engine by OISF.
• tinc - tinc is a Virtual Private Network (VPN) daemon that uses tunnelling and encryption to create a secure private mesh network between hosts on the Internet.

Red

• Apache with mod_security - ModSecurity is a web application firewall that can work either embedded or as a reverse proxy.
• Avahi - Avahi is a system which facilitates service discovery on a local network.
• HAVP antivirus - HTTP Antivirus Proxy with a ClamAV anti-virus scanner.
• LADVD - Send and decode link layer advertisements. Support for LLDP (Link Layer Discovery Protocol), CDP (Cisco Discovery Protocol), EDP (Extreme Discovery Protocol) and NDP (Nortel Discovery Protocol).
• Lightsquid - High performance web proxy report (LightSquid). Proxy realtime stat (SQStat). Requires squid HTTP proxy.
• mtr-nox11 - Enhanced traceroute replacement
• netio - Network benchmark tool.
• nut - Network UPS Tools
• Proxy Server with mod_security - Web application firewall that can work either embedded or as a reverse proxy.
• siproxd - Proxy for handling NAT of multiple SIP devices to a single public IP.
• squid - High performance web proxy cache.
• squidGuard - High performance web proxy URL filter.
• Zabbix-2 Agent - Monitoring agent.
• Zabbix-2 Proxy - Monitoring agent proxy.

Monitorización

• bandwidthd - Tracks usage of TCP/IP network subnets and builds html files with graphs to display utilization.
• darkstat - darkstat is a network statistics gatherer.
• iftop - Realtime interface monitor (console/shell only)
• pfflowd - Converts OpenBSD PF status messages (sent via the pfsync interface) to Cisco NetFlow datagrams.
• mailreport - Periodic e-mail reports containing command output, log file contents, and RRD graphs.
• ntopng - A network probe that shows network usage in a way similar to what top does for processes.
• softflowd - Softflowd is flow-based network traffic analyser capable of Cisco NetFlow data export.
• urlsnarf - HTTP URL Sniffer (console/shell only)
• vnstat2 - Vnstat is a console-based network traffic monitor. The vnstat PHP frontend and vnstati adds a more user friendly way of displaying traffic usage.

Servicios

• Apcupsd - Set of programs for controlling APC UPS.
• arping - Broadcasts a who-has ARP packet on the network and prints answers.
• AutoConfigBackup - Automatically backs up the pfSense configuration file. All contents are encrypted before being sent to the server. Requires Gold Subscription from https://portal.pfsense.org
• bacula-client - Bacula is a set of Open Source, computer programs that manage backup, recovery, and verification of computer data across a network of computers of different kinds.
• bind - The most widely used name server software
• Check_mk agent - The basic idea of check_mk is to fetch "all" information about a target host at once. For each host to be monitored check_mk is called by Nagios only once per time period.
• Cron - The cron utility is used to manage commands on a schedule.
• Dansguardian - An award winning Open Source web content filter.
• dns-server - pfSense version of TinyDNS which features failover host support
• freeradius2 - A free implementation of the RADIUS protocol.
• git - GIT Source Code Management (console/shell only)
• haproxy-devel - The Reliable, High Performance TCP/HTTP(S) Load Balancer.
• imspector - An Instant Messenger transparent proxy with logging capabilities. Currently it supports MSN, AIM, ICQ, Yahoo and IRC to different degrees.
• iperf - A tool for testing network throughput, loss, and jitter.
• mailscanner - An e-mail security and anti-spam package for e-mail gateway systems.
• NRPE v2 - An addon for Nagios that allows plugins to be executed on remote Linux/Unix hosts.
• Open-VM-Tools - VMware Tools (open source)
• PHPService - PHP run as a service it can do anything PHP can do including but not limited to monitoring files, CPU, RAM, and send alerts to the syslog.
• Postfix Forwarder - Postfix mail forwarder acts as a relay server for a domain.
• Service Watchdog - Monitors for stopped services and restarts them.
• Shellcmd - The shellcmd utility is used to manage commands on system startup.
• spamd - Graylisting SMTP connection forwarder.
• syslog-ng - Syslog-ng independent syslog server.
• TFTP - Trivial File Transport Protocol is a very simple file transfer protocol.
• Varnish3 - Varnish is a state-of-the-art, high-performance HTTP accelerator.
• vHosts - It is a web server package that can host HTML, Javascript, CSS, and PHP.
• widentd - RFC1413 auth/identd daemon with fixed fake reply

Sistema

• Backup - Tool to Backup and Restore files and directories.
• blinkled - Allows system LEDs to be used for network activity on supported platforms (ALIX, WRAP, Soekris, etc)
• gwled - Allows system LEDs to be used for gateway status on supported platforms (ALIX, WRAP, Soekris, etc)
• RRD Summary - Gives a total amount of traffic passed In/Out during this and the previous month.
• System Patches - A package to apply and maintain custom system patches.

Routeo

• olsrd - The olsr.org OLSR daemon is an implementation of the Optimized Link State Routing protocol.
• OpenBGPD - OpenBGPD is a FREE implementation of the Border Gateway Protocol, Version 4.
• Quagga OSPF - OSPF routing protocol using Quagga
• routed - RIP v1 and v2 daemon.

Misc

• File Manager - PHP File Manager
• Filer - Allows files to be created and overwriteen from the GUI.
• LCDproc - LCD display driver
• Notes - Track things to note for this system.
• pfBlocker - Introduces Enhanced Aliastable Feature to pfsense.
• Sarg - Squid Analysis Report Generator.

Fuentes:
https://blog.pfsense.org/?p=1810
https://www.gugms.net/pfsense