Installation

One command, run on the firewall, works from any starting state and keeps the package catalogue correct across pfSense upgrades.

Recommended: install from the project repository#

Run this on the firewall over SSH, as root, choosing the channel you want:

fetch -qo - https://pkg.pfblockerng.com/install.sh | sh -s -- --channel stable

fetch -qo - https://pkg.pfblockerng.com/install.sh | sh -s -- --channel testing

fetch -qo - https://pkg.pfblockerng.com/install.sh | sh -s -- --channel edge

fetch -qo - https://pkg.pfblockerng.com/install.sh | sh -s -- --channel nightly

The script detects your pfSense edition and version, configures the matching package catalogue, and keeps it correct across pfSense OS upgrades. The repository takes precedence over the Netgate catalogue, so the webConfigurator's Install and Update buttons pick up its builds too. It is safe to re-run: a firewall that is already set up makes no changes.

Choose Stable unless you specifically want prerelease builds. A firewall subscribes to exactly one channel.

What you get: the Software tab#

Firewall ▸ pfBlockerNG ▸ Software shows your channel and installed version against the repository's latest, and can check for and install updates. Upgrades stay within the channel you are subscribed to. A daily background check raises one pfSense notification per new version; a checkbox on the tab turns it off.

Upgrading from the command line works too:

pkg upgrade pfSense-pkg-pfBlockerNG

Switching channels#

Run the same command with a different channel. It moves the subscription and the installed package onto it, replaces a legacy pfSense-pkg-pfBlockerNG-devel install with the canonical package, and verifies your pfBlockerNG configuration before reporting success.

Upgrading to v4: the 3.3 bridge#

Stable is the 3.3.x bridge to v4. It still looks and works like v3, on purpose: it saves a copy of your pfBlockerNG settings so v4 can convert them, and so you can come back.

• Coming from the Netgate 3.2.x package? If you already have pfBlockerNG settings, install the 3.3 bridge (the Stable command above) first; the v4 install stops and tells you to. A firewall with no pfBlockerNG settings yet can go straight to v4.
• 3.3 to v4 is one-way. v4 stores your 3.3 settings as they are at that moment, then rewrites the live settings into the v4 layout: new names, new pages, new options. That rewrite never runs backwards; new v4 options have no place on 3.3.
• Going back to 3.3 (run the Stable command again) does not translate v4 into v3. You get your 3.3 settings exactly as you left them before the v4 install. Anything you set up only on v4 is not carried back.
• Returning to v4 later brings back your v4 settings as you left them. The two copies are never mixed.

Leave Keep Settings enabled on Firewall ▸ pfBlockerNG ▸ General (it is on by default), and back up the pfSense configuration before each move. v4 is a prerelease: try it on a lab box or a VM with a snapshot first. Want to help? Follow the v4 Beta Tester walkthrough.

Alternative: pfSense Package Manager#

pfBlockerNG may also be available in System ▸ Package Manager ▸ Available Packages. Netgate controls whether, and which version, that catalogue carries, and it usually lags behind the project repository. Installs from it have no Software tab; pfSense's own update badge covers them.

Advanced: manual repository configuration#

pkg.pfblockerng.com also lists the repository configuration for each channel, for hand-written setups. The installer writes it for you, so most firewalls never need it. The same page lists the published versions for every pfSense release, and older builds.

Check the install#

1. Confirm pfBlockerNG appears under System ▸ Package Manager ▸ Installed Packages.
2. Open Firewall ▸ pfBlockerNG. On a project-repository install, the Software tab shows your channel.
3. Continue with General setup.