pfSense Package Management - Install and Update

The pfSense package manager provides a centralized interface for installing, updating, and removing additional system components. All operations are performed through the web interface at System > Package Manager, which communicates with the official Netgate repository. Packages extend firewall functionality without requiring modifications to the base system - each package receives its own configuration page in the web interface upon installation and is managed as a standard pfSense service.

Accessing the Package Manager

The package manager is located at System > Package Manager and contains two primary tabs:

The Available Packages tab displays packages in alphabetical order with name, current version, and brief description. The search field at the top of the page allows locating packages by name or keywords.

Installing Packages

To install a new package:

1. Navigate to System > Package Manager > Available Packages
2. Locate the desired package using search or scrolling
3. Click the Install button next to the package
4. Confirm the installation in the dialog box

After confirmation, pfSense downloads the package and its dependencies from the repository, performs the installation, and displays progress in real time. Upon completion, a new menu entry for the package configuration appears in the web interface.

Warning:

pfSense requires access to DNS servers and internet connectivity through the WAN interface for package downloads. Installation will fail if DNS resolution or routing to the repository is unavailable.

Package Dependencies

Some packages require additional libraries or components to function. The package manager automatically resolves dependencies and installs all necessary components alongside the primary package. Dependencies are marked with a dedicated icon in the manager interface.

When removing a package, dependencies not used by other packages are removed automatically. However, if a dependency is shared among multiple packages, it is retained until the last dependent package is removed.

Updating Packages

Update availability is checked on the Installed Packages tab. When a newer version is available for an installed package, update information appears alongside the current version number.

To update a package:

1. Navigate to System > Package Manager > Installed Packages
2. Locate the package with an available update
3. Click the update icon (double arrows)
4. Confirm the update

Reinstalling a Package

When experiencing issues with a package, reinstallation without changing the version may be necessary. The reinstall icon next to the package on the Installed Packages tab performs this operation. Reinstallation preserves the current package configuration.

Packages During System Upgrades

When upgrading pfSense to a new version, all installed packages are reinstalled automatically. However, not all packages may be compatible with the new system version at the time of upgrade. Check package compatibility before upgrading pfSense and prepare for temporary unavailability of certain packages.

Removing Packages

To remove a package:

1. Navigate to System > Package Manager > Installed Packages
2. Click the remove icon (trash can) next to the package
3. Confirm removal

Package removal deletes its configuration from the system. Before removal, creating a backup through Diagnostics > Backup & Restore is recommended in case settings need to be restored.

Warning:

Package removal irreversibly deletes its configuration. If the package is reinstalled later, configuration must be performed from scratch. Save a backup before removing.

Available Package Categories

The official pfSense repository contains over 60 packages organized by purpose:

Security and Threat Detection

Proxies and Load Balancing

VPN and Remote Access

Network Services

Monitoring and Diagnostics

Command-Line Package Management

When the web interface is unavailable, package operations can be performed from the command line (SSH or console).

Listing Installed Packages

pkg info | grep pfSense-pkg

Reinstalling a Package

pkg install -f pfSense-pkg-<package_name>

Upgrading All Packages

pkg upgrade

Warning:

Command-line package management should only be used when the web interface is inaccessible. The pkg command does not perform pfSense-specific integration steps for the web interface, which may result in an inconsistent system state.

Backing Up Package Configuration

Configuration for all installed packages is stored in the main pfSense configuration file (/cf/conf/config.xml). When creating a backup through Diagnostics > Backup & Restore, package settings are included automatically.

When restoring configuration to a clean pfSense installation:

1. Restore the configuration through Diagnostics > Backup & Restore
2. Navigate to System > Package Manager > Installed Packages
3. Reinstall all previously installed packages - pfSense will restore their configuration from the backup

AutoConfigBackup

For automatic configuration backup (including package settings), the built-in AutoConfigBackup feature (Services > Auto Config Backup) provides continuous protection. The service automatically saves the configuration on every change and maintains a version history.

Troubleshooting

Package Fails to Install

1. Verify DNS availability - Diagnostics > DNS Lookup, enter pkg.pfsense.org
2. Verify internet routing - Diagnostics > Ping, target 8.8.8.8
3. Confirm that WAN firewall rules do not block outbound traffic
4. Check available disk space - Diagnostics > Command Prompt, run df -h
5. Review system logs: Status > System Logs > System > General

Dependency Errors

When dependency errors occur, refresh the package database:

1. Navigate to Diagnostics > Command Prompt
2. Execute pkg update -f
3. Retry the package installation

Package Installed but Not Visible in Menu

1. Clear the browser cache and reload the page
2. Reinstall the package through System > Package Manager > Installed Packages
3. If the issue persists, reboot pfSense through Diagnostics > Reboot

Corrupted Package Database

For severe package manager issues, database recovery may be required:

pkg-static clean -ay
pkg-static install -fy pkg
pkg-static update -f

After executing these commands, reboot pfSense and retry package installation.

Repository Access Issues

When encountering repository errors, verify:

1. DNS configuration at System > General Setup > DNS Servers
2. Default gateway presence at System > Routing > Gateways
3. No blocking rules for outbound HTTPS traffic (port 443)
4. VPN tunnel status if pfSense connects to the internet through a VPN

Package Management Best Practices

Minimize Package Count

Each installed package increases resource consumption and expands the attack surface. Install only the packages genuinely required for the current deployment. Periodically review the installed package list and remove unused ones.

Plan Updates

Package updates may temporarily interrupt service operation. Schedule updates during periods of minimal load and create a configuration backup beforehand. After updating, verify the functionality of each updated package.

Version Compatibility

When upgrading pfSense to a new major version, not all packages may be immediately available in the updated repository. Review the release notes and verify compatibility of critical packages before upgrading the system.

Status Monitoring

Regularly check the Installed Packages tab for available updates. Package updates frequently contain security fixes and performance improvements.

Related Sections

• Suricata IDS/IPS - installing and configuring the intrusion detection system
• pfBlockerNG - IP address and DNS request blocking
• HAProxy - reverse proxy and load balancing
• pfSense Backup and Restore - complete backup and restoration guide