pfSentinel

Automated backup and monitoring tool for pfSense firewalls. Built for homelabs.

pfSentinel connects to your pfSense devices over SSH or HTTPS and backs up configuration files, RRD data, package configs, DHCP leases, certificates, logs, ZFS snapshots, and full filesystem archives. It includes change detection, compression, scheduled backups, and notifications via Telegram, Slack, or Windows toast.

A Word From the Developer

I was looking for a feature-rich, modern pfSense backup tool and only found projects that were no longer maintained. Since pfSense backups are part of my own homelab backup infrastructure, I decided to build pfSentinel and share it with the pfSense community.

If you have a request or an idea, I'd love to hear it, please open a feature request. You can also reach me on LinkedIn or through my website.

Features

• Full config backup via SSH (SFTP) or HTTPS with CSRF-aware login
• Extended backup targets -- RRD graphs, package configs, DHCP leases, alias files, certificates, system logs
• ZFS snapshots with incremental send (pfSense 2.5+)
• Filesystem archives (tar.gz) as a non-ZFS fallback
• Change detection -- only saves when config sections actually change
• SHA-256 verification for every backup file
• Scheduled backups via Windows Task Scheduler, systemd user timers or cron
• Notifications -- Telegram, Slack, Windows toast
• SSH key authentication -- no password required
• Strict SSH host key checking -- confirm the pfSense key once (pfs device trust-key); a changed key is refused
• Credential security -- passwords in the OS keyring (or an AES-256-GCM encrypted store on headless systems), never in config files
• Self-update -- check for and install new releases from GitHub
• Cross-platform -- Windows and Linux (macOS best effort)
• Reproducible CI -- lint, tests, security audit and build defined with Dagger, so the same pipeline runs on your machine and in GitHub Actions; hash-verified lockfiles and SHA-pinned Actions

Quick Start

Download a pre-built binary (no Python required):

Windows (pfs.exe) | Linux (pfs)

Or install from PyPI (Python 3.13+), same command on Linux and Windows:

pipx install pfsentinel

Plain pip install pfsentinel also works in a virtualenv or on Windows; on Ubuntu 23.04+ and Debian 12+ the system Python blocks it, so use pipx there.

Then:

pfs setup          # guided first-time wizard
pfs device add     # add your pfSense device
pfs backup run     # run your first backup

See the Installation Guide for all installation methods.

Documentation

What Gets Backed Up

Third-Party Credits

pfSentinel is built on these open-source libraries:

Paramiko is the only runtime dependency with a copyleft license (LGPL-2.1). When installed via pip, users can freely replace it. For binary releases, pfSentinel uses --onedir bundling so Paramiko remains replaceable. See docs/LICENSE_AUDIT.md for the full dependency license audit.

Contributing

Contributions are welcome! Please read the Contributing Guide before submitting a pull request.

If you find a bug or have a feature request, open an issue.

Support

pfSentinel is free and open source. If it saves you time or you'd like to support continued development, you can sponsor on GitHub or buy me a coffee. Thank you!

License

Apache 2.0