pfSense 2026: Installation on a Mini PC, What's the Best Choice?

pfSense CE is a FreeBSD-based firewall and router distribution. It installs directly on the hardware and completely wipes the target disk. This tutorial first answers the question in the title (which mini-PC to choose), then walks through the installation as it is done today with the Netgate Installer: writing the USB drive, running the installer, assigning the WAN/LAN interfaces, and the web wizard. The mini-PC you use doesn’t matter for what follows: the steps are the same on any hardware.

Which mini-PC should you choose for pfSense?

A router needs at least two network interfaces: one for the WAN (your ISP box or ONT) and one for the LAN. That is the main criterion, ahead of CPU power. Netgate’s documentation requires at least a 64-bit amd64 CPU, 1 GB of RAM and an 8 GB disk. It also notes that quality network cards such as Intel use less CPU than low-end cards.

Minisforum MS-A2: according to published specifications, it has two 10 GbE SFP+ ports (Intel X710 controller) and two 2.5 GbE RJ45 ports (Intel i226-V). That gives it enough ports for a WAN, a LAN and extra networks (OPT1, DMZ…). Its CPU and M.2 slots go far beyond what pfSense needs. It is a good choice if you want 10 GbE or plan to virtualize later. Still check the network controllers on the revision you receive: pciconf -lv lists them from the pfSense shell.
ASUS NUC 14 Pro: it has only one Ethernet port. As shipped, it cannot act as a standard WAN/LAN router. You need either a managed 802.1Q switch, with WAN and LAN on separate VLANs over a single cable (“router-on-a-stick”), or an additional network interface. USB-to-Ethernet adapters are often discouraged for a firewall because their stability varies a lot depending on the FreeBSD driver. For pfSense, it is not the simplest choice.

For storage, an SSD (SATA or NVMe) of a few tens of GB is plenty for pfSense. A bigger drive adds nothing unless you plan on heavy logging or many packages.

Prerequisites

An amd64 mini-PC with two or more network interfaces (or an 802.1Q switch if you only have one port).
A dedicated SSD: everything on it will be erased.
A USB flash drive for the installer: its contents will be erased too.
A monitor and keyboard connected to the mini-PC for the console.
Internet access on the WAN port during installation: the Netgate Installer downloads pfSense from Netgate’s servers.
A computer on the LAN for the web wizard.

Step-by-step installation

Step 1: Download the Netgate Installer

Go to the official page pfSense.com. pfSense CE is now downloaded through the Netgate Installer, distributed via Netgate’s online store (there is no longer a direct ISO of the latest release). Choose the AMD64 architecture and the compressed USB memstick image (.img.gz): it works with both a monitor (VGA) and a serial console. Also get the checksum file if one is provided.

cd ~/Downloads
ls -lh *.img.gz
# If a .sha256 file is provided, compare the displayed sum with its contents:
sha256sum netgate-installer-amd64.img.gz   # adjust to the exact file name
cat netgate-installer-amd64.img.gz.sha256

Check: the two SHA256 hashes must be exactly identical. If they differ, download the file again.

Step 2: Write the image to the USB drive

The simplest method, recommended by Netgate, is balenaEtcher (Windows, macOS, Linux). It reads the .img.gz image directly: choose “Flash from file”, then the drive under “Select target”, then “Flash!”. On Linux you can also use dd.

⚠️ Warning: dd overwrites the target device without asking. Identify the USB drive with certainty first:

lsblk -o NAME,SIZE,MODEL,TRAN,MOUNTPOINTS
# Find the line where TRAN = usb and the size matches your drive (e.g. sdb).
# If the drive is mounted, unmount its partitions:
sudo umount /dev/sdX?* 2>/dev/null

Replace sdX with the name you found (for example sdb), never with your system disk:

gunzip -c netgate-installer-amd64.img.gz | sudo dd of=/dev/sdX bs=4M status=progress conv=fsync
sync

Check: lsblk /dev/sdX should now show new partitions on the drive. If your operating system offers to “format” the drive, decline: it simply can’t read these FreeBSD partitions.

Step 3: Prepare the mini-PC and boot from the USB drive

Plug the WAN cable (to the ISP box or ONT) into the port you are reserving for the WAN. Leave the LAN port unplugged for now, or connect it to your switch.
Insert the USB drive, power on and open the firmware (UEFI) boot menu.
If the drive doesn’t show up or won’t boot, check in the UEFI that USB boot is allowed. Also try disabling Secure Boot.

Check: the Netgate Installer License screen appears. Press Enter to Accept.

Step 4: Configure networking in the installer

In the Welcome Menu, choose Install. The installer then moves on to network setup:

Select WAN Interface: pick the WAN interface. The list shows each interface’s MAC address and link state (“(up)” means a cable is plugged in). Compare with the MAC addresses printed on the mini-PC’s label if needed.
Interface Mode: DHCP (Client) (the default, behind an ISP box), STATIC (IP/CIDR, gateway, DNS) or PPPoE (ISP username and password). You can also set a VLAN here, which is useful for router-on-a-stick on a single-port NUC.
Select LAN Interface: pick the LAN port. By default it gets the address 192.168.1.1/24, and a DHCP server hands out addresses 192.168.1.100 to 192.168.1.150. If your ISP box already uses 192.168.1.0/24, pick another subnet for the LAN (for example 192.168.10.1/24) to avoid a conflict.
Confirm Network Configuration → Continue.

Check: the installer must reach Netgate’s servers. If it shows a connection error, fix the WAN interface choice or its mode, then retry.

Step 5: Choose the edition, the disk, and install

The installer checks whether the hardware is eligible for pfSense Plus. On a generic mini-PC, choose Install CE.
File System: keep ZFS (the default and recommended choice, with boot environments). UFS uses fewer resources. Partition Scheme: GPT by default.
Select the target disk. On FreeBSD, disks are not called /dev/sdX: an NVMe SSD shows up as nda0 (or nvd0), a SATA SSD as ada0, a USB drive as da0. Don’t pick da0, it is probably your installation drive. Go by the size and model shown.
Confirm the warning: everything on the disk will be destroyed.
Choose the version from the list (usually Current Stable Version), then OK. The installer downloads and writes the files.
When it finishes, choose reboot and remove the USB drive before the machine boots from the SSD.

Check: after the reboot, the pfSense console menu appears, with the WAN and LAN interface addresses and numbered options (1 Assign Interfaces, 2 Set interface(s) IP address, 8 Shell…).

Step 6: Check interfaces and disk from the console

If the interfaces are swapped or missing, use option 1) Assign Interfaces, then option 2 to change the LAN IP address. To open a FreeBSD shell, type 8. The following commands run there (not on a Linux PC):

ifconfig -l                      # list interfaces (e.g. igc0 igc1 ixl0 ixl1)
pciconf -lv | grep -B3 -i network # detected network controllers
geom disk list | grep -E "Geom name|Mediasize|descr"   # disks (nda0, ada0…)
zpool status                     # ZFS pool status (if ZFS was chosen)
ping -c 3 www.netgate.com        # Internet and DNS connectivity from pfSense

Check: zpool status shows state: ONLINE, and ping gets replies (0.0% packet loss). Type exit to return to the menu.

Step 7: Web setup wizard

Connect a computer to the LAN port. It should get an address via DHCP. Open https://192.168.1.1 (or the LAN address you chose): the interface already uses HTTPS, with a self-signed certificate you need to accept. Log in with the default credentials admin / pfsense. The wizard (System > Setup Wizard) then guides you through: hostname and DNS, time server and time zone, WAN configuration, LAN address, then a new admin password (mandatory), and finally Reload.

From a Linux machine on the LAN:

ip -4 addr show                  # does the machine have an address on the pfSense LAN?
ping -c 3 192.168.1.1            # does pfSense reply?
curl -skI https://192.168.1.1 | head -n 1   # does the web interface respond (HTTP 200)?
curl -sI https://www.pfsense.org | head -n 1  # does Internet work through pfSense?

Check: every command gets a response, and Status > Dashboard shows the WAN with an IP address.

Verification checks

Status > Interfaces: WAN and LAN are “up”, with their IP addresses.
Diagnostics > Ping: a ping to a domain name from the WAN interface succeeds.
Status > System Logs: no repeated errors on the interfaces.
Status > DHCP Leases: your LAN machines are listed.

Security and best practices

Never expose the web interface or SSH on the WAN. By default, pfSense blocks all inbound traffic on the WAN: don’t add any rule that opens port 443 or 22 on the WAN. For remote administration, use a VPN (WireGuard or OpenVPN).
Change the admin password (the wizard requires it). If several people manage the firewall, create named accounts in System > User Manager.
The web interface already uses HTTPS. To replace the self-signed certificate, use System > Cert. Manager (create an internal CA or import a certificate), then select the certificate in System > Advanced > Admin Access.
SSH is disabled by default. Only enable it if you need it, preferably with key-based authentication, and only on the LAN.
There are no automatic system updates: check for them and run them yourself in System > Update (or with the “Update from console” option in the console menu). The firewall needs Internet access.
Before every update, back up the configuration in Diagnostics > Backup & Restore.

Troubleshooting common errors

Symptom: the installer can’t reach Netgate’s servers. Cause: wrong WAN interface, wrong mode (DHCP instead of PPPoE), or a VLAN required by the ISP. Solution: go back to the network screen, check for “(up)” on the WAN port and check the chosen mode.
Symptom: you can’t open https://192.168.1.1. Cause: the machine isn’t on the LAN port, didn’t get a DHCP address, or LAN and WAN were swapped. Solution: check the addresses shown on the console. Use option 1 to reassign the interfaces and option 2 for the LAN address.
Symptom: no Internet on the LAN even though pfSense has a WAN IP. Cause: the LAN subnet is the same as the ISP box’s, or DNS is misconfigured. Solution: change the LAN subnet (option 2) and test with Diagnostics > DNS Lookup.
Symptom: the mini-PC reboots into the installer. Cause: the USB drive is still plugged in or takes priority in the UEFI. Solution: remove the drive and put the SSD first in the boot order.

FAQ

How do I install a pfSense update?

In System > Update, choose the branch, wait for the check, then start the update after backing up the configuration. Nothing happens automatically: check regularly.

My mini-PC won’t boot from the SSD.

Make sure the SSD is the first boot device in the UEFI and that the USB drive is removed. If the problem persists, reinstall using the GPT partition scheme.

Can I use a mini-PC with a single Ethernet port, such as the ASUS NUC 14 Pro?

Yes, but only with a managed 802.1Q switch and separate VLANs for WAN and LAN, or with an extra network interface. Without one of these, pfSense can’t separate the WAN from the LAN.

Can I run pfSense in a virtual machine?

Yes, it is possible (for example on Proxmox) using the ISO image, with interfaces dedicated to the WAN and the LAN. On the machine itself, pfSense is the only system: it isn’t designed to dual-boot alongside another OS.