pfSense on Dad's a Nerd!

pfSense Hardware Guide: What to Actually Buy

Thu, 13 Aug 2026 14:31:25 -0400

Short answer: for most homes, an Intel N100 mini PC with two or more Intel i226-V ports, 8 GB of RAM, and a small SSD handles a gigabit connection without effort and draws about as much power as a light bulb. If you’d rather not think about it, a Netgate appliance starts at $269 with pfSense Plus included.

The rest of this post is about the decisions underneath that answer — because the specification that matters most isn’t the CPU, and two of the numbers you’ll see quoted everywhere don’t mean what they appear to mean.

Tailscale vs. WireGuard on pfSense: Which Should You Run?

Wed, 12 Aug 2026 19:12:37 -0400

Short answer: run WireGuard on pfSense if you can open a UDP port, and add Tailscale if you’re behind CGNAT or need to hand access to people who won’t edit a config file. The encryption is identical — Tailscale is WireGuard with a control plane on top. The deciding factor on pfSense is that FreeBSD can’t run Tailscale’s kernel mode, so subnet routing and exit nodes go through a userspace stack, which changes how packets are forwarded and makes exit node duty noticeably slow.

VLAN Segmentation on pfSense: Guest & IoT Networks

Tue, 11 Aug 2026 17:31:22 -0400

Split one flat LAN into three isolated networks — trusted LAN, guest Wi-Fi, and IoT — each on its own VLAN and subnet, with firewall rules that actually enforce the isolation rather than just labeling it. Covers renumbering off the default 192.168.1.1, creating the VLANs, and the specific allow/block rules each network needs.

Why segment at all

A single flat network means every device — laptops, phones, guest devices, smart plugs, cameras, the TV — can see and reach every other device. That’s fine until one of them shouldn’t be trusted: a guest’s phone with unknown malware, or an IoT device with a firmware vulnerability the manufacturer never patched (both a genuine, ongoing category of problem, not a hypothetical). Segmentation means a compromised or just poorly-secured device on the Guest or IoT network can’t reach anything on the trusted LAN, because there’s no route there to begin with — not “we trust it not to,” but “the firewall doesn’t permit it.”

DNS over TLS on pfSense: Encrypt Unbound's Upstream Queries

Tue, 11 Aug 2026 16:57:45 -0400

Every unencrypted DNS query leaves the network in plaintext — your ISP, and anyone else on the path, sees every domain being looked up, even if the site itself is HTTPS. DNS over TLS (DoT) encrypts that query between pfSense’s Unbound resolver and the upstream DNS provider, closing that specific gap. This is the resolver both WireGuard guides already point client DNS at — this post covers securing it.

What this does and doesn’t protect

	Covered by DoT	Not covered
ISP seeing which domains you look up	Yes	—
On-path DNS spoofing/tampering of the upstream query	Yes	—
Traffic content once a connection is made	—	No — DoT is DNS only, not a VPN
Which IPs you connect to (visible via the connection itself)	—	No — SNI/IP are still visible unless also using something like encrypted SNI or a VPN
Local, LAN-side query visibility (anyone on your LAN)	—	No — DoT only covers the pfSense-to-upstream leg

DoT vs. DoH — why this guide uses DoT

Unbound (pfSense’s resolver) has native, GUI-exposed support for DNS over TLS. It does not natively speak DNS over HTTPS (DoH) as a client — getting DoH would mean chaining Unbound to an external DoH-capable forwarder (e.g., cloudflared) running as a separate service, adding a moving part for no real security difference at the resolver level. DoT is the natural fit for pfSense’s built-in tooling; use it unless something specific requires DoH.

Multi-Site VPN on pfSense: Connect Multiple Locations with WireGuard (No Vendor Fees)

Tue, 11 Aug 2026 16:11:27 -0400

Connects multiple pfSense-routed locations into one routed, dual-stack (IPv4 + IPv6) network using WireGuard — a self-hosted multi-site VPN on pfSense in a hub-and-spoke topology. No NAT, no per-site static IP requirement, no recurring vendor fee.

Terminology note: the underlying technique here is a site-to-site VPN — a permanent, routed tunnel connecting two networks. “Multi-site” just means using that same technique more than once: a hub site runs a separate site-to-site tunnel to each additional location. Two sites is the base case (one tunnel, one peer on each end); three or more is that same setup repeated, with the hub acting as the common point. Nothing about the core configuration changes as sites are added — Step 2 through Step 5 are simply repeated per additional spoke.

pfSense WireGuard IPv6 Setup: Full Tunnel and Split Tunnel Guide

Mon, 10 Aug 2026 21:08:26 -0400

Setting up a home WireGuard VPN on pfSense gets you your own private, self-hosted VPN — no subscription, no third-party logging policy to trust, just your own router. This guide walks through a complete pfSense WireGuard setup with IPv6 covering both major connection modes (full tunnel and split tunnel), dual-stack IPv4 and IPv6 addressing, a stable hostname via Cloudflare Dynamic DNS, and the firewall/NAT rules that actually make traffic pass — not just handshake.