Skills and Competencies for IT Staff Trained in pfSense

Basic Networking Knowledge

Note: If the fundamentals in this section are not proficient, additional catching up and self-study will be required before proceeding with pfSense-specific configurations.

Networking Fundamentals

Understand the purpose and function of a network: connecting devices, sharing resources, and enabling communication.
Identify common network devices: switches, routers, firewalls, access points, servers, and client devices.
Learn IP addressing basics (IPv4/IPv6), subnetting, and DNS/DHCP roles. Static and Dynamic IP, NAT (Network Address Translation) basics.

Typical Configurations

Home vs. enterprise network setups. The critical techniques in scaling and managing larger and larger networks. How to organize and track hosts and IPs and servers.
Understanding of wired vs. wireless connections and their use cases. The ability to troubleshoot latency, wireless interference (channel assignment), and optimization.
VPN creation - WireGuard, ZeroTier, and paid VPN services.

Core Networking Setup

WAN and LAN Configuration

Set up WAN connection with ISP (DHCP, PPPoE, or Static IP).
Configure LAN interface for internal network.
Assign DHCP or static IP addressing for devices.

Interfaces

Add, remove, and configure additional interfaces.
Bind interfaces to networks with proper IP ranges.

Troubleshooting

Backup and Restore

Perform manual configuration backups and restores.
Configure AutoConfigBackup service.
Regularly download and archive backup files for recovery assurance.

Connections and Firewall Logs

Analyze firewall logs to identify blocked/allowed traffic and misconfigurations.
Trace connection attempts and NAT translations.

Performance Checks

Monitor and reconfigure RRD data collection for accuracy.
Reassess load balancing configurations when performance issues arise.

Upgrade/Resource Justification

Gather data from graphs, logs, and monitoring tools to support the case for hardware upgrades or prioritization of resources.

pfBlockerNG for Bandwidth Efficiency

Use pfBlockerNG to block ads and trackers.
Prevent preloading of ads and video content, which can otherwise cause significant bandwidth consumption.

Intermediate Configuration

VLANs (Virtual LANs)

Create VLAN interfaces.
Tag VLANs appropriately for segmentation.
Configure inter-VLAN routing and access restrictions.

Aliases

Define host, network, and port aliases for easier firewall rule management.
Use aliases to simplify large or frequently updated rule sets.
Leverage aliases to help design and assign VLANs without tracing every device manually, while still physically tagging devices and connections for accuracy and accountability.

Gateway Groups

Configure multiple gateways.
Set up load balancing across ISPs.
Set up failover for redundancy.

Firewall Fundamentals

Firewall Rules

Understand pass, block, and reject behavior.
Configure rules for WAN, LAN, and VLAN interfaces.
Implement rules for DMZ environments.

DMZ Setup

Place public-facing servers in isolated segments.
Apply strict firewall rules between DMZ, LAN, and WAN.

QoS (Quality of Service)

Configure traffic shaping to prioritize critical applications (VoIP, ERP, video conferencing).
Manage bandwidth allocation to prevent congestion.

VPN and Tunnels

VPN Basics

Configure IPsec for site-to-site and secure remote connections.
Set up OpenVPN for flexible client access.

WireGuard (Preferred)

Deploy WireGuard as the primary VPN due to its simplicity and performance.
Highlight cost-effectiveness: can run on a Contabo VM (~₱4,000/year) compared to costly ISP-provided IP addresses.
Using the WireGuard Docker in a VM, administrators can create unlimited VPN groups, since it leverages UDP hole punching and coordinating servers for efficient scaling.

Advanced

Captive Portal

Configure pfSense Captive Portal for guest or managed access networks.
Note that Captive Portal can be resource-intensive, requiring significant bandwidth and processing power.
May require a dedicated system to run efficiently in large deployments.

Graphing and Dashboarding

Go beyond built-in RRD graphs with advanced monitoring and visualization.
Integrate external dashboard tools (Grafana, InfluxDB, etc.).
Build custom dashboards for latency, throughput, and traffic analysis to support proactive troubleshooting.