pfAdmin User Guide

Last updated: 1 July 2026

pfAdmin is a native iPhone and iPad client for administering a pfSense firewall over SSH. It installs nothing on the firewall and uses no cloud service: your device talks directly to your firewall and back. This guide walks through setup and every major feature.

Getting started

You need:

  • A pfSense (or compatible) firewall you administer.
  • SSH enabled on that firewall, reachable from your device (on the LAN, or over your VPN).
  • A login with root / admin privileges. pfAdmin reads and writes the firewall configuration, which requires the administrator account.
  • An iPhone or iPad on iOS 17.6 or later.
Why root? Many screens read /conf/config.xml and run configuration tools that are restricted to the administrator. A non-privileged user can connect but will hit permission errors on the rules, NAT and similar screens.

Enable SSH on pfSense

On the firewall's web interface:

  1. Go to System → Advanced → Admin Access.
  2. Under Secure Shell, tick Enable Secure Shell.
  3. Choose an authentication method. Password or public key is the simplest to start with; key-only is more secure (see below).
  4. Leave the SSH port at 22 unless you have changed it, then Save.
  5. Make sure a firewall rule allows SSH from the network you will connect from (by default LAN is allowed).
Do not expose SSH directly to the internet. To reach your firewall remotely, use the built-in VPN and connect to SSH over the tunnel.

Optional: key-based access

pfAdmin can generate and install an SSH key pair for you. When adding or editing a server, choose the key option and follow the on-device setup: pfAdmin creates a key in the iOS Keychain and appends the public key to the firewall's authorised keys, so future connections use the key instead of your password.

Add your firewall

  1. Open pfAdmin. On first launch you are taken to Add Server. (You can return any time via More → Servers & Settings → Add Server.)
  2. Fill in the details:
    • Name - a label for this firewall (e.g. "Home pfSense").
    • Host - the IP address or hostname (e.g. 192.168.1.1).
    • Port - the SSH port, usually 22.
    • Username - root (or your admin account).
    • Authentication - password, or a generated/imported SSH key.
  3. Tap Test Connection. pfAdmin connects, shows the firewall's host key, and asks you to trust it (see next section).
  4. Save. pfAdmin stores the credentials in the device Keychain and opens the dashboard.

Trust the host key

The first time you connect, pfAdmin shows the firewall's SSH host key fingerprint and asks you to trust it. This is what proves you are talking to your firewall and not an impostor. pfAdmin pins the key you trust.

  • On later connections the key is checked automatically and silently.
  • If the key ever changes, pfAdmin refuses to connect and warns you. This is expected after reinstalling pfSense or regenerating its SSH keys; if you did not expect it, treat it as a red flag. Remove and re-add the server (or re-trust) only once you are sure the new key is genuine.

App lock (Face ID / Touch ID)

Because pfAdmin holds privileged access to your firewall, you can require biometric unlock every time the app opens.

  1. Go to More → Servers & Settings.
  2. Under Security, turn on Require Face ID (or Touch ID).

A device passcode must be set for this to be available. If Face ID fails, iOS falls back to your passcode.

Dashboard

The Dashboard tab is your at-a-glance health view:

  • CPU, memory, disk and temperature, plus uptime and pfSense version.
  • Gateway status and latency, and a summary of running services.
  • Live traffic. Tap a card to drill into the detailed screen behind it.

Pull to refresh at any time. Cards reflect the currently selected firewall.

Firewall

The Firewall tab covers everything under Firewall in pfSense:

  • Rules - view rules per interface, create, edit, enable/disable, delete, and drag to reorder. Changes are staged and then applied in one step, exactly like the web UI.
  • Aliases - manage host, network and port aliases used by your rules.
  • NAT - Port Forwards - inbound port-forward rules.
  • NAT - Outbound / 1:1 / NPt - outbound, one-to-one and IPv6 prefix translation.
  • Virtual IPs - CARP, IP alias and proxy ARP addresses.
  • Schedules - time-based schedules that rules can reference.
  • State Table - live firewall states; search and reset states.

Quick-block an address

From Logs, the State Table or Top Talkers, swipe or tap an address and choose Block. pfAdmin adds the address to a block alias / rule so you can shut down a noisy or malicious host in seconds.

Network

The Network tab groups connectivity features:

  • Live Traffic - real-time throughput for an interface.
  • All Interfaces Traffic - every interface at once for a whole-box view.
  • Interfaces - status, addresses and link details; enable or disable an interface.
  • Gateways - status, latency and packet loss; useful for multi-WAN.
  • DHCP Leases - active and static leases; jump to block or inspect a client.
  • Static Mappings - reserve an IP for a MAC address.
  • Routing - static routes and gateway groups.
  • DNS Overrides - host overrides for the DNS Resolver / Forwarder.
  • VPN - see the VPN section.

Services

The Services tab lists the daemons on your firewall (DNS Resolver, DHCP, NTP, and any package services). For each you can Start, Stop or Restart, and see whether it is currently running.

Diagnostics and tools

Under More you will find a full toolbox:

  • Quick Actions - common one-tap tasks such as restarting the web GUI.
  • Live Logs and Logs - stream and filter system, firewall and service logs, with pass/block filtering and search.
  • Top Talkers - the busiest hosts by traffic, with one-tap block.
  • Traffic History - longer-term graphs from the firewall's RRD data.
  • Network Tools - ping, traceroute and DNS lookups from the firewall.
  • System Info - detailed hardware and OS information.
  • ARP & Command - the ARP table plus a safe command runner.
  • SSH Console - an interactive shell to the firewall when you need it.

Packet analyser

pfAdmin includes a built-in, Wireshark-style packet analyser that runs entirely on your device - no desktop needed.

  1. Open More → Packet Capture.
  2. Pick the interface, an optional filter and a packet/time limit, then start the capture. It runs on the firewall.
  3. When it finishes, pfAdmin pulls the .pcap and opens the Packet Inspector.

In the inspector you get:

  • A three-pane view: packet list, layer-by-layer detail and a hex dump.
  • Decoding for Ethernet, IP, TCP/UDP, and application protocols including DNS, DHCP, TLS/SNI and HTTP, with plain-language explanations of what each field means.
  • Display filters to narrow the list, Follow TCP stream to read a conversation end to end, and per-conversation statistics.
  • Export the .pcap to share or open in another tool.

System and maintenance

Under More → System:

  • System - device details and actions including reboot and halt.
  • Users - view, create and manage user accounts and groups.
  • Packages & Updates - installed packages and available system updates.
  • Certificates - certificates and authorities, with expiry visibility (and optional expiry alerts).
  • pfBlockerNG - when the package is installed: status, top blocked domains, block lists with address counts, and a temporary per-address unblock (swipe an address; the feed's next reload restores it).
  • Configuration Backup and Config History - see below.

Backup and restore

  • Configuration Backup - download the firewall's config.xml to your device. You can protect the backup with encryption.
  • Restore - upload a saved configuration back to the firewall.
  • Config History - browse the firewall's own revision history, compare revisions line by line (against the current config or the previous revision) and restore one once you have reviewed the diff.
Restoring replaces live configuration. Take a fresh backup first and make sure you can still reach the firewall (locally or over VPN) before applying a restore.

VPN and remote access

The VPN screen gives read-only monitoring of the VPN servers running on your firewall: OpenVPN, IPsec and WireGuard tunnels, with live status and diagnostics.

Away from home, do not expose SSH to the internet. Connect to your firewall's own VPN first, then use pfAdmin against the firewall's LAN address exactly as if you were at home:

  1. Set up a mobile VPN on pfSense (WireGuard, OpenVPN or IPsec/IKEv2).
  2. Connect from iOS using the matching client: the WireGuard or OpenVPN app, or iOS's built-in IKEv2 support for IPsec.
  3. Open pfAdmin and connect to the firewall's LAN address across the tunnel.
Any of the three works; WireGuard is the usual choice for phones because reconnects are quick and battery cost is low.

Alerts and Home Screen widget

In More → Servers & Settings you can enable background Update & outage alerts. When enabled, pfAdmin periodically checks your selected firewall in the background and posts local notifications for:

  • available system or package updates,
  • the firewall going unreachable (an outage),
  • certificates that are close to expiring,
  • health thresholds - CPU, memory or temperature over a limit you set, and gateway packet loss or latency over a limit,
  • a new device appearing on your network, and
  • a configuration change being written on the firewall.

Thresholds and per-alert switches live in the Health Alerts screen in Settings. Numeric alerts fire when a value crosses its limit, with a margin so a value hovering at the limit does not nag you.

Add the pfAdmin widget to your Home Screen for an at-a-glance status of your firewall without opening the app. The small and medium widgets show your selected firewall; the large widget lists every firewall at a glance.

Network Health

Network Health (in Settings) watches the quality of your internet connection and the size of your network over time. It is optional and off by default.

  • Scheduled speedtest - your firewall runs a periodic speedtest (download, upload, ping, jitter, detected ISP and test server) against a public endpoint, so the result reflects your real connection, not your phone's. Nothing is installed on pfSense.
  • LAN device scan - an active scan of your own network for an accurate live device count and list.
  • History and charts - results are logged on your device (pruned after 60 days) with 24-hour, 7-day and 30-day charts for throughput, latency and device count.
  • Alerts - a periodic summary notification with a rendered 24-hour throughput chart and a plain-language account of what changed.
  • PDF reports - export the whole report (summary, charts and recent runs) as a PDF to share or archive.
The interval you choose is a minimum; runs happen when the app is next active or refreshed in the background. You can also tap Run now at any time. Every measurement stays on your device - see the Privacy Policy.

Siri and Shortcuts

pfAdmin exposes App Intents you can use with Siri, the Shortcuts app, the Action Button and Control Centre's Shortcut control:

  • Firewall status - ask for a quick health summary.
  • Gateway status - are the gateways up or down.
  • Block an IP - block an address hands-free.
  • Restart a service - Siri asks which one.
  • Reload the filter - reload the pf ruleset.
  • Reboot the firewall - with confirmation.

Multiple firewalls

Add as many firewalls as you like. Switch between them from More → Servers & Settings, and use All Servers for a combined overview of every firewall you manage.

Security and privacy

  • Credentials are stored only in the on-device iOS Keychain. They are not synced to iCloud and never sent anywhere except to authenticate with your firewall.
  • Connections use SSH with host-key pinning.
  • There is no analytics, tracking or third-party SDK, and no data goes to the developer.
  • Enable the app lock and a device passcode if others can reach your device.

See the Privacy Policy for full detail.

Troubleshooting

Common issues and fixes are on the Support page. The most frequent ones:

  • Cannot connect - confirm SSH is enabled, the port is right, and a firewall rule allows SSH from your network.
  • Permission errors on Rules/NAT - connect as root / an admin account.
  • Host key changed warning - only re-trust if you know why the key changed (see Trust the host key).
Still stuck? Head to Support or email info@d4vinder.com.