Install pfSense from a Bootable USB Drive

This guide walks you through installing pfSense, the open-source firewall and router distribution, onto a dedicated PC or appliance using a bootable USB drive. You’ll end up with a fully functional pfSense system ready for initial configuration. Before starting, you’ll need the pfSense ISO image, a USB drive (8 GB or larger), a tool to write the image, and a computer that meets pfSense’s minimum hardware requirements (64-bit CPU, at least 1 GB RAM, and a 16 GB hard drive).

What You’ll Need

A USB drive (8 GB or larger) – all data on it will be erased.
The pfSense Community Edition ISO image, downloaded from the official pfSense website.
A utility to write the ISO to USB, such as Rufus (Windows), balenaEtcher (Windows/macOS/Linux), or the dd command (Linux/macOS).
A computer that meets pfSense’s minimum requirements: 64-bit CPU, at least 1 GB RAM, and a 16 GB hard drive or SSD.
Optional: a monitor and keyboard for the installation console (or a serial console if your hardware supports it).

Step-by-Step

Download the pfSense ISO. Go to the official pfSense website and download the latest Community Edition ISO (amd64 architecture). Choose the file ending in .iso.
Prepare your USB drive. Insert the USB drive into your computer. Back up any important files because the next step will erase it.
Write the ISO to USB.
- Windows (Rufus): Open Rufus, select your USB drive under “Device,” click “SELECT” to choose the pfSense ISO, then click “START.” When prompted about writing in ISO or DD mode, choose “DD mode” and confirm. Rufus will warn that all data will be destroyed – click “OK.”
- macOS/Linux (balenaEtcher): Open balenaEtcher, click “Flash from file,” select the ISO, choose the USB drive, and click “Flash.” Enter your password if prompted.
- Linux/macOS (dd): Open a terminal and run sudo dd if=/path/to/pfSense.iso of=/dev/sdX bs=4M status=progress (replace /dev/sdX with your USB device name – be very careful not to overwrite your system disk).
Eject the USB drive safely. Once the write completes, eject the USB drive from your computer.
Connect the target hardware. Plug the USB drive into the computer where you want to install pfSense. Connect a monitor and keyboard to that computer.
Boot from the USB drive. Power on the computer and press the key that opens the boot menu (commonly F11, F12, Esc, or Del – the exact key is usually shown on the first screen). Select the USB drive from the boot menu.
Choose the installer option. When the pfSense boot menu appears, select “Boot Multi User” (or just press Enter) to start the installer.
Accept the license. The pfSense license agreement appears – press Enter to accept.
Select the keymap. Choose your keyboard layout (default is “Standard” for US) and press Enter.
Start the installer. Select “Install pfSense” and press Enter.
Choose the disk. The installer will show a list of available disks. Select the hard drive or SSD where pfSense should be installed (not the USB drive). If you’re not sure, note the disk size – the USB drive is usually smaller and you should avoid it.
Confirm the disk layout. The installer will ask if you want to use the entire disk – select “Yes” and press Enter. This will erase the selected disk.
Wait for installation. The installer will copy files to the disk. This may take a few minutes.
Set the console password. After installation, you’ll be prompted to set a password for the root user. Enter a strong password and confirm it.
Reboot. The installer will ask you to reboot. Remove the USB drive when prompted, then press Enter to reboot the system.
Initial boot. pfSense will boot from the hard drive. You’ll see a series of messages and then a menu on the console. The default LAN IP address is 192.168.1.1, and the WAN interface is set to DHCP by default.
Complete initial configuration via web interface. Connect a computer to one of the LAN ports on the pfSense machine. Open a web browser and go to https://192.168.1.1. Accept the self-signed certificate warning. Log in with username admin and the password you set during installation. Follow the setup wizard to configure your WAN and LAN settings.

Common Mistakes

Writing the ISO in the wrong mode. In Rufus, if you choose “ISO mode” instead of “DD mode,” the USB drive may not boot. Always use DD mode for pfSense.
Selecting the wrong disk during installation. If you accidentally install pfSense onto the USB drive itself, the installation will be lost when you remove the USB. Double-check the disk size and name.
Not disabling Secure Boot. Some UEFI systems with Secure Boot enabled will refuse to boot pfSense from USB. Temporarily disable Secure Boot in the BIOS/UEFI settings.
Using a USB 3.0 port on older hardware. Some older systems have trouble booting from USB 3.0 ports. Try a USB 2.0 port instead.
Forgetting to back up the USB drive. Writing the ISO erases everything on the USB drive. Always back up first.

Tips

Use a high-quality USB drive. A cheap or faulty USB drive can cause boot failures or installation errors. Test the drive before using it.
Check hardware compatibility. pfSense supports most Intel and AMD NICs, but some Realtek NICs can cause issues. If possible, use hardware with Intel NICs.
Keep the USB drive for recovery. After installation, you can keep the USB drive as a rescue disk. If the system fails, you can boot from it and reinstall.
Write down your settings. During the initial web configuration, note your WAN IP, subnet mask, and gateway – you’ll need them if you restart the setup.
Update pfSense after installation. Once you have internet connectivity, go to System > Update and install the latest updates to get security patches and bug fixes.

Troubleshooting

The system does not boot from USB. Check the boot order in BIOS/UEFI and ensure the USB drive is first. Try a different USB port (preferably USB 2.0). Disable Secure Boot if enabled. If the USB drive still doesn’t boot, re-write the ISO using DD mode (Rufus) or try a different tool like balenaEtcher.
Installation fails with an error. This is often caused by a corrupted ISO or a faulty USB drive. Re-download the ISO and verify its checksum (the SHA256 hash listed on the download page). Re-write the USB drive and try again.
pfSense boots but the console shows “No interfaces detected.” This means pfSense didn’t recognize your network cards. Check that your NICs are supported (Intel and Broadcom are well-supported). If you’re using a USB NIC, it may not be supported – use built-in ports.
Web interface is not accessible. Ensure your computer is on the same subnet as pfSense’s LAN (default 192.168.1.0/24). Try setting your computer’s IP to 192.168.1.100 with a subnet mask of 255.255.255.0. Also, check that you’re using the correct protocol (https, not http) and that you accepted the self-signed certificate.
Forgot the console password. If you forget the root password, you’ll need to reinstall pfSense. There is no password recovery by default.
Installation hangs at “Installing pfSense.” This can happen if the disk is failing or incompatible. Try a different hard drive or SSD. Also, ensure the disk is not too old or too small (pfSense needs at least 16 GB).

Frequently Asked Questions

Can I install pfSense on a USB drive and run it from there?

Yes, but it’s not recommended for production use. USB drives are slower and have limited write endurance, which can lead to premature failure. For testing, it’s fine, but for a permanent firewall, install to a hard drive or SSD.

Does pfSense require a lot of RAM?

Minimum is 1 GB, but 2 GB or more is recommended for better performance, especially if you use packages like Snort or Squid. For home use with basic routing, 2 GB is plenty.

Can I install pfSense on a virtual machine?

Yes, pfSense runs well on VMware, VirtualBox, Proxmox, and other hypervisors. The installation process is the same – just mount the ISO as a virtual CD/DVD and boot from it.

How do I update pfSense after installation?

Log in to the web interface, go to System > Update, and click “Update.” You can also update from the console menu (option 13) if you have internet connectivity.

Is pfSense free?

pfSense Community Edition is free and open-source. There is also a commercial version called pfSense Plus, which offers additional features and support, but the Community Edition is fully functional for most users.

Can I use pfSense as a wireless access point?

pfSense does not support wireless client mode or acting as an access point natively. You would need to use a separate wireless access point connected to the LAN.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →