{"id":154,"date":"2015-08-29T17:59:14","date_gmt":"2015-08-29T17:59:14","guid":{"rendered":"http:\/\/onebyte.org\/blog\/?p=154"},"modified":"2022-05-01T07:57:26","modified_gmt":"2022-05-01T12:57:26","slug":"useful-pfsense-commands","status":"publish","type":"post","link":"https:\/\/www.onebyte.org\/blog\/2015\/08\/29\/useful-pfsense-commands\/","title":{"rendered":"Useful pfSense commands"},"content":{"rendered":"

\"\"<\/p>\n

Here are some commands that I’ve compiled over my time working with pfSense. My pfSense cheat sheet!<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Description<\/strong><\/td>\nCommand<\/strong><\/td>\n<\/tr>\n
Reload the Firewall with all the configuration. This also restarts the webgui and sshd \u2013 but keeps the current ssh sessions active just as a regular sshd restart.<\/td>\n\/etc\/rc.reload_all<\/strong><\/td>\n<\/tr>\n
Manually edit the configuration in \/conf\/config.xml. Once file has been saved and editor exited, the \/tmp\/config.cache is removed so the next config reload event will load config.xml, not the cached version. You could run the next command to trigger an instant reload.<\/td>\nviconfig \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<\/strong><\/td>\n<\/tr>\n
\u00a0<\/td>\n\u00a0<\/strong><\/td>\n<\/tr>\n
Show rule\/filter information<\/td>\npfctl -s rules<\/strong><\/td>\n<\/tr>\n
Show rule\/filter info for what FILTER rules hit<\/td>\npfctl -v -s rules<\/strong><\/td>\n<\/tr>\n
Show rule\/filter info, includes rule counters, ID numbers, etc.<\/td>\npfctl -vvsr<\/strong><\/td>\n<\/tr>\n
Shows the current state table<\/td>\npfctl -ss<\/strong><\/td>\n<\/tr>\n
Shows current filter rules<\/td>\npfctl -sr<\/strong><\/td>\n<\/tr>\n
Show as much as possible.<\/td>\npfctl -sa<\/strong><\/td>\n<\/tr>\n
Shows current NAT rules<\/td>\npfctl -sn<\/strong><\/td>\n<\/tr>\n
Show NAT information for which rules hit<\/td>\npfctl -v -s nat<\/strong><\/td>\n<\/tr>\n
Show NAT information for interface GE1<\/td>\npfctl -s nat -i ge1<\/strong><\/td>\n<\/tr>\n
Show QUEUE information<\/td>\npfctl -s queue<\/strong><\/td>\n<\/tr>\n
Show LABEL information<\/td>\npfctl -s label<\/strong><\/td>\n<\/tr>\n
Show contents of the STATE table<\/td>\npfctl -s state<\/strong><\/td>\n<\/tr>\n
Show statistics for state tables and packet normalization<\/td>\npfctl -s info<\/strong><\/td>\n<\/tr>\n
Show everything<\/td>\npfctl -s all<\/strong><\/td>\n<\/tr>\n
Enable the packet filter \u2013 enables all firewall<\/strong> functions<\/td>\npfctl -e<\/strong><\/td>\n<\/tr>\n
Disable the packet filter \u2013 disables all firewall<\/strong> functions<\/td>\npfctl -d<\/strong><\/td>\n<\/tr>\n
Run qiuet<\/td>\npfctl -q<\/strong><\/td>\n<\/tr>\n
\u00a0<\/td>\n\u00a0<\/td>\n<\/tr>\n
flush ALL<\/td>\npfctl -F all<\/strong><\/td>\n<\/tr>\n
flush only the RULES<\/td>\npfctl -F rules<\/strong><\/td>\n<\/tr>\n
flush only queues<\/td>\npfctl -f queue<\/strong><\/td>\n<\/tr>\n
flush only NAT<\/td>\npfctl -F nat<\/strong><\/td>\n<\/tr>\n
pfctl -F info<\/td>\nflush all stats that are not part of any rule<\/strong><\/td>\n<\/tr>\n
pfctl -z clear<\/td>\nall counters<\/strong><\/td>\n<\/tr>\n
Playback Scripts<\/strong><\/td>\n\u00a0<\/td>\n<\/tr>\n
Changes password for the defined user. Prompts to reset the account properties if it is disabled or expired<\/td>\npfSsh.php playback changepassword<\/strong><\/td>\n<\/tr>\n
Enable\/Disable CARP high availability functions. Will deactivate the CARP virtual IP addresses. Does not persist across reboots.<\/td>\n\n

pfSsh.php playback disablecard<\/strong><\/p>\n


pfSsh.php playback enablecarp
<\/strong><\/p>\n<\/td>\n<\/tr>\n

Enable\/Disable CARP maintenance mode. This leaves CARP active but demotes the unit so that another can assume control. Maintenance mode will persist across reboots.<\/td>\n\n

pfSsh.php playback disablecarpmaint
<\/strong><\/p>\n

pfSsh.php playback enablecarpmaint<\/strong><\/p>\n<\/td>\n<\/tr>\n

Removes all DHCP configuration from the firewall causing DHCP to be disabled. It completely removes all of its settings.<\/td>\n\n

pfSsh.php playback disabledhcp<\/strong><\/p>\n<\/td>\n<\/tr>\n

Disables the HTTP_REFERER<\/em> check in Browser HTTP_REFERER enforcement<\/a>. This can aid in gaining access to the GUI if the browser session is triggering this protection.<\/td>\n\n

pfSsh.php playback disablereferercheck<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Adds an allow all rule for IPv4 and IPv6 to the WAN interface<\/p>\n

Be extremely careful with this option, it is meant to be a temporary<\/strong> measure to gain access to services on the WAN interface of the firewall in situations where the LAN is not usable. Once proper access rules are put in place, remove the rules added by this script.<\/em><\/span><\/p>\n<\/td>\n

\n

pfSsh.php playback enableallowallwan<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Enables the SSH daemon – same as the menu option or in the GUI<\/p>\n<\/td>\n

\n

pfSsh.php playback enablesshd<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

This script looks for a config.xml<\/em> file on the external device, such as a USB drive. Then move it in place for use by the firewall.<\/p>\n<\/td>\n

\n

pfSsh.php playback externalconfiglocator<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Prints the current gateway status and statistics. This also accepts an optional parameter brief<\/em>, which prints only the gateway name and status, omitting the addresses and statistical data.<\/p>\n<\/td>\n

\n

pfSsh.php playback gatewaystatus<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Creates a new self-signed certificate for the firewall and activates for use in the GUI. This can be useful in cases where the previous certificate is invalid or unusable. It also fills in the certificate details using the firewall hostname and other custom information for better identifying your host.<\/p>\n<\/td>\n

\n

pfSsh.php playback generateguicert<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

A complex script that synchronizes the PHP and other script sources with the files from the pfSense GitHub repository. This is most useful on development snapshots to pick up changes from more recent commits.<\/p>\n

This script can be dangerous to use in other circumstances. Only use this under the direction of a knowledgeable developer or support representative.<\/span><\/strong><\/p>\n<\/td>\n

\n

pfSsh.php playback gitsync<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

\u00a0<\/p>\n<\/td>\n

\n

pfSsh.php playback install pkg<\/strong><\/p>\n

pfSsh.php playback listpkg<\/strong><\/p>\n

pfSsh.php playback uninstallpkg<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

View additional rules in anchors from packages or features, such as UPnP.<\/p>\n<\/td>\n

\n

pfSsh.php playback pfanchordrill<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Prints the contents of all pf <\/em>tables, which contain addresses used in firewall aliases, as well as built-in system tables for features such as bogon network blocking, snort, and GUI\/SSH lockout. This is also useful for checking if a specific IP address is found in any table, rather than searching individually.<\/p>\n<\/td>\n

\n

pfSsh.php playback pftabledrill<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Removes all traces of package configuration data from the running config.xml<\/em>. This can be useful if a package has corrupted settings or has otherwise left the packages in an inconsistent state.<\/p>\n<\/td>\n

\n

pfSsh.php playback removepkgconfig<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Removes ALTQ traffic shaper settings, which can be useful if the shaper configuration is preventing rules from loading or is otherwise incorrect and preventing proper operations of the firewall.<\/p>\n<\/td>\n

\n

pfSsh.php playback removeshaper<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Resets the GUI settings for widgets, dashboard columns, the theme, and other GUI-related settings. It can return the GUI, particularly the dashboard, to a stable state if it is not functioning properly.<\/p>\n<\/td>\n

\n

pfSsh.php playback resetwebgui<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Disables and re-enables each WAN-type interface, which reapplies the interface configuration<\/p>\n<\/td>\n

\n

pfSsh.php playback restartallwan<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Stops and restarts the DHCP daemon<\/p>\n<\/td>\n

\n

pfSsh.php playback restartdhcpd<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Rewrites and reloads the IPsec configuration for strongSwan<\/p>\n<\/td>\n

\n

pfSsh.php playback restartipsec<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

Controls the services running on the firewall, similar to interacting with services at Status<\/strong> > Services<\/strong><\/p>\n

The\u00a0action<\/strong>\u00a0can be\u00a0stop<\/em>,\u00a0start<\/em>, or\u00a0restart<\/em>.<\/p>\n

The\u00a0service name<\/strong>\u00a0is the name of the services as found under\u00a0Status > Services<\/strong>. If the name includes a space, enclose the name in quotes.<\/p>\n

The\u00a0service-specific options<\/strong>\u00a0vary depending on the service, they are used to uniquely identify services with multiple instances, such as OpenVPN or Captive Portal entries.<\/p>\n<\/td>\n

\n

pfSsh.php playback svc<\/strong><\/p>\n

playback svc <action> <service name> [service-specific options]<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

\u00a0<\/p>\n<\/td>\n

\n

\u00a0<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

The shell version of Easy Rule,\u00a0easyrule<\/em>, can add a firewall rule from a shell prompt. When the\u00a0easyrule\u00a0<\/em>command is run without parameters, it prints a usage message to explain its syntax.<\/p>\n

The way\u00a0easyrule\u00a0<\/em>adds a block rule using an alias, or a precise pass rule specifying the protocol, source, and destination, work similar to the GUI version.<\/p>\n

\u00a0<\/p>\n<\/td>\n

\n

easyrule pass\/block <interface> <protocol> <source IP> <destination ip> [destination port]<\/strong><\/p>\n

easyrule pass wan tcp 0.0.0.0\/0 192.168.0.1 80<\/p>\n

easyrule pass wan icmp 1.1.1.1 192.168.0.1<\/p>\n

easyrule block wan 1.1.1.1<\/p>\n<\/td>\n<\/tr>\n

show table addvhosts<\/td>\npfctl -t addvhosts -T show<\/strong><\/td>\n<\/tr>\n
view global information about all tables<\/td>\npfctl -vvsTables<\/strong><\/td>\n<\/tr>\n
add entry to table addvhosts<\/td>\npfctl -t addvhosts -T add 192.168.1.50<\/strong><\/td>\n<\/tr>\n
add a network to table addvhosts<\/td>\npfctl -t addvhosts -T add 192.168.1.0\/16<\/strong><\/td>\n<\/tr>\n
delete nework from table addvhosts<\/td>\npfctl -t addvhosts -T delete 192.168.1.0\/16<\/strong><\/td>\n<\/tr>\n
remove all entries from table addvhosts<\/td>\npfctl -t addvhosts -T flush<\/strong><\/td>\n<\/tr>\n
delete table addvhosts entirely<\/td>\npfctl -t addvhosts -T kill<\/strong><\/td>\n<\/tr>\n
reload table addvhosts on the fly<\/td>\npfctl -t addvhosts -T replace -f \/etc\/addvhosts<\/strong><\/td>\n<\/tr>\n
find ip address 192.168.1.40 in table addvhosts<\/td>\npfctl -t addvhosts -T test 192.168.1.40<\/strong><\/td>\n<\/tr>\n
load a new table definition<\/td>\npfctl -T load -f \/etc\/pf.conf<\/strong><\/td>\n<\/tr>\n
stats for each ip address in table addvhosts<\/td>\npfctl -t addvhosts -T show -v output<\/strong><\/td>\n<\/tr>\n
\n

reset all counters for table addvhosts<\/p>\n<\/td>\n

pfctl -t addvhosts -T zero<\/strong><\/td>\n<\/tr>\n
\n

Manual restart of openVPN process<\/p>\n<\/td>\n

echo “<?php include(‘openvpn.inc’); openvpn_resync_all();?>” | php -q<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u00a0<\/p>\n\n","protected":false},"excerpt":{"rendered":"

Compiled list of pfsense commands that I use as my cheat sheet.<\/p>\n","protected":false},"author":1,"featured_media":1023,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","footnotes":""},"categories":[3,18,21],"tags":[12,11,10],"class_list":["post-154","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","category-networking","category-software","tag-commands","tag-firewall","tag-pfsense"],"uagb_featured_image_src":{"full":["https:\/\/www.onebyte.org\/blog\/wp-content\/uploads\/2015\/08\/pf_moo.png",800,235,false],"thumbnail":["https:\/\/www.onebyte.org\/blog\/wp-content\/uploads\/2015\/08\/pf_moo-150x150.png",150,150,true],"medium":["https:\/\/www.onebyte.org\/blog\/wp-content\/uploads\/2015\/08\/pf_moo-300x88.png",300,88,true],"medium_large":["https:\/\/www.onebyte.org\/blog\/wp-content\/uploads\/2015\/08\/pf_moo-768x226.png",768,226,true],"large":["https:\/\/www.onebyte.org\/blog\/wp-content\/uploads\/2015\/08\/pf_moo.png",800,235,false],"1536x1536":["https:\/\/www.onebyte.org\/blog\/wp-content\/uploads\/2015\/08\/pf_moo.png",800,235,false],"2048x2048":["https:\/\/www.onebyte.org\/blog\/wp-content\/uploads\/2015\/08\/pf_moo.png",800,235,false],"post-thumbnail":["https:\/\/www.onebyte.org\/blog\/wp-content\/uploads\/2015\/08\/pf_moo.png",800,235,false],"modality-logo":["https:\/\/www.onebyte.org\/blog\/wp-content\/uploads\/2015\/08\/pf_moo-272x80.png",272,80,true]},"uagb_author_info":{"display_name":"Mr-Moo","author_link":"https:\/\/www.onebyte.org\/blog\/author\/ahess\/"},"uagb_comment_info":1,"uagb_excerpt":"Compiled list of pfsense commands that I use as my cheat sheet.","_links":{"self":[{"href":"https:\/\/www.onebyte.org\/blog\/wp-json\/wp\/v2\/posts\/154","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.onebyte.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.onebyte.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.onebyte.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.onebyte.org\/blog\/wp-json\/wp\/v2\/comments?post=154"}],"version-history":[{"count":2,"href":"https:\/\/www.onebyte.org\/blog\/wp-json\/wp\/v2\/posts\/154\/revisions"}],"predecessor-version":[{"id":1024,"href":"https:\/\/www.onebyte.org\/blog\/wp-json\/wp\/v2\/posts\/154\/revisions\/1024"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.onebyte.org\/blog\/wp-json\/wp\/v2\/media\/1023"}],"wp:attachment":[{"href":"https:\/\/www.onebyte.org\/blog\/wp-json\/wp\/v2\/media?parent=154"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.onebyte.org\/blog\/wp-json\/wp\/v2\/categories?post=154"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.onebyte.org\/blog\/wp-json\/wp\/v2\/tags?post=154"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}