FAQ
Find answers to common questions about what pfSense Actions supports, how it handles security, and where to get help.
Product
Can pfSense Actions change firewall rules or run any command?
No. It runs only its allowlisted commands, and the operations console manages tokens, activity, the connection, notifications, and the administrator account, not firewall settings.
Why use pfSense Actions instead of an API package on pfSense?
pfSense Actions needs only SSH and commands that ship with pfSense, so nothing extra gets installed on the firewall. It also limits each client to four actions and the scopes you grant.
Can one deployment manage several firewalls?
No. Each deployment stores the connection for one target firewall.
Can pfSense Actions tell me when the firewall goes down?
Yes. Add a notification destination that chose pfSense can't be reached, and a scheduled check signs in to pfSense every 5 minutes and sends the alert after two failures in a row, as described in Notifications.
pfSense
Which pfSense versions work?
pfSense Actions doesn't check the version, and there's no tested version list yet. It needs SSH and the whoami, uname, ping, and wol commands, and bug reports are considered for the releases Netgate lists as supported.
Can I use a hostname for the firewall?
No. The connection takes an IPv4 or IPv6 address, both in PFSENSE_SSH_IP and on the console's pfSense Connection page.
Does it support IPv6?
The request bodies and the connection accept IPv6 addresses, but IPv6 targets aren't covered by tests. Wake-on-LAN needs an IPv4 broadcast address, because IPv6 doesn't have one.
Does it check the firewall's SSH host key?
Not yet. It accepts whichever host key the server presents, so it's recommended to keep the path to the firewall on a trusted network, as described in the Security Model.
Security
Can I expose pfSense Actions directly to the internet?
It's not recommended, because the listener serves plain HTTP and each token stays valid until it expires or is revoked. A reverse proxy with HTTPS, as in HTTPS Reverse Proxy, keeps tokens encrypted in transit.
What should I do if a token leaks?
Revoke it on the console's Access tokens page, which rejects it from the next request on. Then create a replacement for the client, as described in Access Tokens.
Where are secrets stored?
The controller database holds each token hash, the encrypted pfSense credential, the encrypted TOTP secret, and the encrypted secret fields of each notification destination, while the encryption key stays in its own file. Data at Rest has the details.
What happens if the encryption key is lost?
pfSense Actions makes a new key at the next start and removes only the saved pfSense password or private key, the authenticator app, and the secret fields of notification destinations, which the console then asks you to enter again. Tokens, passkeys, settings, and the activity log stay, as described in Backup and Recovery.
Support
Where do I report a bug or ask for a feature?
Open an issue in the GitHub repository with the bug report or feature request form.
Can I get one-on-one help?
Support requests are open to GitHub Sponsors and to people who have contributed heavily to the project.