pfSense

This guide covers firewalls and appliances running pfSense CE and pfSense Plus.

Create a dedicated backup account

1. Go to System > User Manager and add a user named netwatch-backup with a strong password.
2. On the user (or a group it belongs to), add the User - System: Shell account access privilege so the account can log in over SSH.
3. The configuration file is readable only with root rights. Either install the sudo package from System > Package Manager and grant the account (or its group) permission to run commands as root under System > sudo, or use the built-in admin account for backups instead.

Enable SSH access

1. Go to System > Advanced > Admin Access and check Enable Secure Shell.
2. Leave SSHd Key Only unset if the account authenticates with a password, or select key-based authentication and install the collector's public key on the account.
3. pfSense only allows SSH from interfaces where a firewall rule permits it. Add a rule allowing TCP port 22 (or your custom SSH port) from the QUARK collector's IP address only.

Platform notes

• pfSense keeps its entire configuration in a single XML file, so one backup captures users, certificates, and package settings.
• Accounts with WebCfg privileges alone cannot log in over SSH; the shell account access privilege is required.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.