pfSense is an open source firewall/router based on FreeBSD. It can however do much more than that, and assume the role of DNS, VPN, DHCP and more.

Installing an ESXi pfSense here is used primarily as a IPSec VPN endpoint, but at the same time it will be used as a firewall/router/DHCP.

This guide will focus on installing pfSense on a dedicated host for ESXi, with multiple IP’s, with one dedicated to pfSense, as there are some pitfalls to the installation of pfSense with a dedicated IP.


    – ESXi installed and configured on the dedicated host.
    – Access to the ESXi to do the network configuring on the VM’s
    – A dedicated IP for the pfSense VM. In this case we are using a failover IP   from OVH, which permits multiple IPs for the same host.
    – A second dedicated IP to permit SSH access to a VM that will be in the LAN of the pfSense VM, to permit access to the web configurator (might not be necessary, but that’s what we will be using in this guide).

Network setup

The first step will be to configure the network on the ESXi to prepare for the pfSense VM.  

pasted image

We firstly create two vSwitches. A vSwitch is a virtual switch in ESXi, which will permit us to separate the two networks we will create.

The first one, which is here named vSwitch0, will be the WAN network for the pfSense host. It is connected to the physical NIC of the ESXi host.

The second one, which is here named LAN, will be our LAN network, which is not connected to any physical NIC on the host, since the pfSense VM will act as a router, all of the connection to the outside will need to go through pfSense.

Once the vSwitches are created, we need to create port group on each vSwitch, to attach the VM’s to.

pasted image 1

pasted image
As we can see, we have on port group called VM Network, that will be the WAN access for pfSense, that is connected to a physical NIC.
pasted image 2
We also have a port group called LAN, that has all of our VMs, and is not connected to any physical NIC.

pfSense installation

You will first need to create the VM in ESXi. 

pasted image 3
pasted image 4
You will need to select FreeBSD as the Guest OS version.
pasted image 5

Then, when customising the settings of the VM, you need to setup the two network adapter, one  to connect to LAN, and one to connect to the WAN network. 

When configuring the WAN interface, you need to set the MAC address manually, with the one given to you with the dedicated IP.

Once everything is setup, you can install pfSense on the VM, with default settings during the installation.

pasted image 6
Select install
pasted image 7
Select your keymap
pasted image 8
Select “Auto (UFS)” for the partitioning scheme, or select manual if you want to customise your partitions 
pasted image 9
You can now reboot into your system

pfSense configuration

Once booted into your system, you should see this screen :  

pasted image 10

You can see that the interfaces were auto-detected by pfSense, and it configured the LAN network, but not the WAN.

We won’t be able to configure the WAN interface from the console, as it does not allow a subnet of /32 to be created from the console.

What we will want to do is access the shell (option 8), and manually configure the routes to get access to internet.

So select the shell, and input those commands:

route del default 

This will remove the default route that pfSense configured.

route add -net -iface em0

You will need to replace with the IP of the dedicated ESXi host, replacing the last byte with 1.

This will add a the default route to the interface em0 (your WAN interface).

route add default

This will add the previously created route as a default route for your pfSense system.

Access the WebConfigurator

Once this is done, you will need to access the webConfigurator, which is only accessible on the LAN of the pfSense.

To do this, we’ve launched an Ubuntu VM, that also has two network cards, one connected to the LAN network, and one connected to the same WAN network as the pfSense VM.

The goal here, is to have outside access to the Ubuntu VM, to be able to make a SSH port redirection to our machine, to get access to the webConfigurator.

The DHCP server is already running, so we can just set the interface to DHCP, and it will give us an IP and setup the routes.

pasted image 11

Now we need access from the outside, so we setup the dedicated IP on the WAN interface on the Ubuntu VM, and setup the routes in the same way as the pfSense VM.

Once we do that, we now have access to internet on the Ubuntu VM : 

pasted image 12

Since we have access to the outside and we configured the public IP, we can now SSH into the machine, and redirect the port 443 on the pfSense server to our PC, so that we can access the webConfigurator.

To do that we redirect the port via a SSH command : 

ssh -vNL 8080: user@server

And now if we visit, we should be able to see this screen 

pasted image 13

We can now login with the default credentials : admin/pfsense

Configuring pfSense

The first time you connect to the webConfigurator, you will have access to the setup assistant. 

pasted image 14
Click on Next
pasted image 15
Click on Next
pasted image 16
Enter the hostname of the pfSense VM, the domain if needed, and a DNS server (here we are using the google DNS)
Click on Next
pasted image 17
Leave the default value on the time server hostname.
Select the Timezone
Click on Next
pasted image 18
This page will allow you to configure the WAN interface.
Select Static
pasted image 19
You can leave the General Configuration blank
pasted image 3
For the IP address, enter the dedicated IP given to you, with a subnet mask of /32.
The gateway must be the IP address of your ESXi host, replacing the last byte with .1
Leave the rest blank, and click on Next
pasted image 20
You can leave those values as default, as you will be able to change them later
pasted image 21
Enter a password for the webInterface
pasted image 22
Click on Reload
pasted image 23

Now that the initial setup is complete, we will need to configure some NAT rules, so that the LAN network can access internet, and make the routing rules permanent.

Note: after configuring the WAN interface, pfSense might delete the route that you previously set manually, in this case you need to enter them again.

Make the routing rules persistent

Because our routing rules are added manually, and will not survive a reboot, we need to execute these commands at boot.

Fortunately, there is a package in pfSense that will allow us to do that. 

To install this package, go to System -> Package Manager -> Available Packages

Search “shellcmd” and install it 

pasted image 24

Once installed, go to Services -> Shellcmd  and add the two routing commands 

pasted image 4

Your internet access will now work after a reboot.

NAT configuration

For the LAN network to access internet, we need to configure the NAT.

Go to Firewall -> NAT -> Outbound

pasted image 25
Click on Manual Outbound NAT rule generation and then save
pasted image 26
You need to Apply the changes

We will now create our own NAT rule.

pasted image 27
Click on the leftmost Add button
pasted image 28

Select the following parameters

    – Interface: WAN
    – Protocol: any
    – Source: any
    – Destination: any

Click then on Save

Apply the changes.

The pfSense VM is now configured as a router for the LAN network with a dedicated IP.

About TrackIt

TrackIt, an Amazon Web Services Advanced Consulting Partner based in Marina del Rey, CA, offers a range of cloud management, consulting, and software development solutions. Their expertise includes Modern Software Development, DevOps, Infrastructure-As-Code, Serverless, CI/CD, and Containerization, with a focus on Media & Entertainment workflows, High-Performance Computing environments, and data storage.

TrackIt excels in cutting-edge software design, particularly in the areas of containerization, serverless architectures, and pipeline development. The company’s team of experts can help you design and deploy a custom solution tailored to your specific needs.

In addition to cloud management and modern software development services, TrackIt also provides an open-source AWS cost management tool to help users optimize their costs and resources on the platform. With its innovative approach and expertise, TrackIt is the ideal partner for organizations seeking to maximize the potential of their cloud infrastructure.

ESXi pfsense server - logo trackit