How to Configure pfSense on Proxmox Dedicated Server

Running a firewall directly on bare metal is traditional, but virtualizing pfSense on a dedicated server using a hypervisor (like Proxmox VE or ESXi) is the modern standard for maximizing hardware efficiency.

By virtualizing, you can route all internet-facing traffic through the pfSense virtual machine (VM) before it reaches your other VMs, creating a secure, isolated local area network (LAN) inside the same physical host.

This tutorial provides a fully updated, step-by-step guide for deploying pfSense CE 2.8.x or pfSense Plus 26.x on a dedicated server running Proxmox VE 8.x (the most common bare-metal hypervisor used in 2026 for this architecture).

1. Architecture and Prerequisites

To deploy this setup without locking yourself out of your server, you need a clear understanding of the network flow.

  • The Hypervisor (Proxmox): Installed directly on the dedicated server.
  • WAN (Wide Area Network): A virtual bridge (vmbr0) connected to the server's physical network interface card (NIC). This passes the public IP directly to the pfSense VM.
  • LAN (Local Area Network): A virtual switch (vmbr1) entirely internal to the hypervisor. This has no physical port assigned. All other VMs will connect to vmbr1 and use pfSense as their default gateway.
  • pfSense Image: Download the latest pfSense CE ISO (FreeBSD-based) from Netgate.

2. Hypervisor Network Preparation

Before creating the VM, configure your hypervisor’s virtual networks. In Proxmox VE:

  1. Navigate to your node > Network.
  2. Locate vmbr0: This bridge should already exist and be linked to your physical NIC (e.g., eno1 or eth0). This is your WAN.
  3. Create vmbr1: Click Create > Linux Bridge.
  4. Name it vmbr1.
  5. IPv4/CIDR: Leave blank (pfSense will handle DHCP and routing for this network).
  6. Bridge ports: Leave blank (this makes it an internal-only switch).
  7. Comment: "LAN Network"
  8. Apply Configuration to reload the network settings.

3. Provisioning the pfSense Virtual Machine

Creating a VM for a firewall requires specific hardware parameters to ensure network throughput and cryptographic performance.

Click Create VM in Proxmox and set the following specs:

  • OS: Select the uploaded pfSense ISO. Set Type to Other.
  • System: Set Machine to q35 and BIOS to OVMF (UEFI). Add an EFI disk.
  • Disks: Set Bus/Device to VirtIO Block. 20GB of storage is more than enough for a standard firewall setup.
  • CPU: Assign 2 Cores. Set the CPU Type to Host. This is critical—setting the type to Host passes through the physical CPU's AES-NI instructions, which hardware-accelerates VPN encryption (IPsec/WireGuard).
  • Memory: Allocate 2048 MB to 4096 MB of RAM (disable ballooning to prevent memory starvation).
  • Network Adapters (Crucial Step):
    • NIC 1 (WAN): Assign to vmbr0. Set the Model to VirtIO (paravirtualized). (Note: If your dedicated server provider requires MAC binding for routed IPs, enter the provider-assigned virtual MAC address here).
    • NIC 2 (LAN): Add a second network device. Assign it to vmbr1. Set the Model to VirtIO (paravirtualized).

4. Installing pfSense CE

  1. Start the VM and open the Proxmox Console.
  2. Follow the standard FreeBSD installer prompts.
  3. When prompted for the file system, select ZFS and choose Stripe (No Redundancy). Because Proxmox typically handles data redundancy at the host level (via hardware RAID or host ZFS), you do not need nested software redundancy inside the VM.
  4. Finish the installation and reboot.

5. Interface Assignment

Upon rebooting, the pfSense console will display a prompt to assign interfaces. Do not skip this, as getting the order wrong will break connectivity.

  • VLANs: Type n (No) for setting up VLANs right now.
  • WAN Interface: Enter vtnet0 (the first VirtIO NIC).
  • LAN Interface: Enter vtnet1 (the second VirtIO NIC).
  • Type y to apply and proceed.

pfSense will automatically assign a 192.168.1.1 address to the LAN interface.

6. Essential Tuning for Virtual Environments

This is the most critical step for virtualized pfSense deployments. By default, FreeBSD VirtIO network drivers conflict with the hypervisor's checksum handling, resulting in massively degraded throughput and dropped packets.

Disable Hardware Checksum Offloading

  1. Deploy a temporary Linux/Windows VM in Proxmox, connect its network interface to vmbr1 (LAN), and let it pull an IP from pfSense.
  2. Open a web browser inside that VM and navigate to https://192.168.1.1.
  3. Log in using default credentials (admin / pfsense) and complete the setup wizard.
  4. Go to System > Advanced > Networking.
  5. Scroll down to Network Interfaces and check the box to Disable hardware checksum offload.
  6. Click Save and reboot the pfSense VM for the changes to take effect at the kernel level.

Enable the QEMU Guest Agent

To allow Proxmox to accurately monitor pfSense RAM usage and send graceful shutdown commands:

  1. Go to System > Package Manager > Available Packages.
  2. Search for and install os-qemu-guest-agent.
  3. In Proxmox, edit the pfSense VM options and enable QEMU Guest Agent.

7. Securing the Hypervisor

Currently, your Proxmox web interface is likely exposed directly to the public internet on vmbr0. The final security step is to move the hypervisor management interface behind your new virtual firewall.

  1. In Proxmox, navigate to the node's Network settings.
  2. Edit vmbr0 (WAN) and remove the Proxmox host IP address and gateway.
  3. Edit vmbr1 (LAN) and assign a static internal IP (e.g., 192.168.1.10/24) and set the gateway to the pfSense LAN IP (192.168.1.1).
  4. Apply the configuration.
Warning! Connectivity Drop Doing this immediately drops your connection to Proxmox. You must now access your dedicated server via a VPN hosted on pfSense (like WireGuard or OpenVPN), or via port forwarding through the pfSense WAN IP. This ensures that no hypervisor ports are directly reachable from the outside world, creating a hardened, enterprise-grade architecture.

Power Your Virtual Infrastructure with Fit Servers Dedicated Hosting

When virtualizing heavy routing loads and complex environments like Proxmox and pfSense, you need a bare-metal foundation that won't buckle under pressure. Fit Servers delivers premium global dedicated server hosting built for uncompromising control and unshakeable stability.

Operating across 250+ locations spanning six continents, Fit Servers provides the enterprise-grade infrastructure necessary for serious virtualization projects:

  • 100% Dedicated Compute: Enjoy complete root access to next-generation CPUs, massive DDR5 RAM allocations, and ultra-fast NVMe SSD storage — no noisy neighbors or shared resources.
  • Massive Network Capacity: Connect to a 5.5 Tbps global network with premium Tier 3 partnerships. Scale from 1Gbps to 100Gbps unmetered bandwidth depending on your routing needs.
  • Total Infrastructure Control: Provision and manage your hypervisors effortlessly through comprehensive API access and an intuitive client portal featuring automated OS reloads, private network configuration, and instant reboots.
  • Enterprise Reliability: All hardware is housed in ISO-certified Tier 3+ data centers with redundant power and advanced cooling, backed by a 100% uptime guarantee and transparent, zero-hidden-fee pricing.

Whether you need rapid pre-configured hardware deployment or specialized GPU and storage servers, deploy your next secure architecture on a platform designed for true performance. Discover how Fit Servers dedicated hosting provides the ultimate bare-metal engine for your virtual environments.


Configure your dedicated server today!