Basics

pfSense 2.9.0 on Proxmox

Installing pfSense 2.9.0 on Proxmox. An update for 2026. Including how to setup the GEMU Guest Agent. And Unbound 1.26.0 security issue fix for older installs.

Photo by Eric Prouzet / Unsplash

Download pfSense 2.9

First you need to download the netgate-installer-v1.2-RELEASE-amd64.iso.gz. Extract it and store the netgate-installer-v1.2-RELEASE-amd64.iso into local or any place you use for your ISOs. I usually use a NFS share called ISOs3.

Create a VM

The VM to use can be really small for a basic internal router or bigger for a edge firewall with many layers of protection. I start with a 1 core 1G RAM and 5 G disk. The PVE status will always show 100% RAM but the pfSense dashboard will show a much smaller number e.g., 30%. Resources used: disk <1G and CPU at 2 - 5% and hardly reaching 50%.

We need two virtual bridges, WAN and LAN ( your numbering may be different):

for WAN - the existing vmbr0
for LAN - we create a new bridge, vmbr1

DNS

I use zones on my Technitium DNS cluster for all my subnets:
lab.home.lan, mgmt.home.lan, srv.home.lan, guest.home.lan, iot.home.lan.

DHCP

Subnets are served by pfSense, IP from range and DNS ns1.home.lan and ns2.home.lan.

Configure

Configure your basic setup in the shell and go to the browser for the rest.

Install the QEMU Guest Agent

Install the package

pkg install qemu-guest-agent

Set parameter

sysrc qemu_guest_agent_enable="YES"

Enable and Start the QGA

service qemu-guest-agent enable

service qemu-guest-agent start

Check for success

service qemu-guest-agent status

You can now safely reboot the VM.

Upgrade

Remember to upgrade your system and apply needed patches too.

Unbound 1.26.0 security issue

Use unbound -V to check the version. If you have a older version than 1.26.1 you might need to fix the security issue, in the shell run pkg update -f; pkg upgrade -y.
If that do not fix it pfSense-upgeade -ds; pkg update; pkg upgrade should fix it.

References

pfSense ^[1] The Issue tracker ^[2]

The pfSense download page ↩︎
Remeber to check the Redmine issue tracker pages, Unbound 1.26.1 ↩︎

Not a new laptop, a new OS

I took my old MacBook Pro (Intel) and upgraded it with a version of Arch Linux, Omarchy. It's beautiful, easy to use, and all based on Arch. It's also a system designed to be the system to use when moving from Windows or Mac to Linux. In two weeks you will learn to love Omarchy 4.0.

Securing a web facing VPS/VM

Setting up a VM or a VPS is easy. But you need to make it secure, and that is hard. Here we discover 2 of the basic tools UFW and Fail2ban. This post is about setup, making it safe and secure and the results running for a day. This is the first step when setting up a new web facing VM or a VPS.

Private Domain with Technitium

To use friendly names instead of IPs. Set up a Private Domain with Technitium. We set up a Domain Name Server ns1 and configure it to handle our domain, example.com or mylab.lan. Options for later: DHCP, a cluster with at least ns1 and ns2 for redundancy, and add ad-blocking if that's needed.

Security for SSH

SSH is the quintessential tool for server administration. But, most servers and VPS are installed with less than optimal settings for SSH. We don't want root to be able to log in, it's a security vulnerability. We don't want to allow the use of passwords for nobody to log in to our servers/VPS.