pfSentinel
Automated pfSense config backups over SSH or HTTPS: config.xml, RRD, certificates, ZFS snapshots and more.
Scheduled on Windows & Linux (tested on Ubuntu). Zero telemetry. 100% local.
$ pipx install pfsentinel
Available on PyPI · GitHub · Releases
Platforms
Everything you need to protect your firewall config
Back up everything (config, RRD, certificates, ZFS snapshots) with scheduling, notifications, and change detection built in.
9 Backup Targets
XML config, RRD graphs, package configs, DHCP leases, aliases, certificates, logs, ZFS snapshots, and filesystem archives.
SSH & HTTPS
Dual-protocol support. SSH via Paramiko with key auth and pinned host keys, HTTPS with automatic CSRF handling.
Change Detection
Classifies config changes: interfaces, firewall rules, system, users, VPN, DHCP, and packages.
Scheduled Backups
Daily and weekly backups via Windows Task Scheduler, systemd timers or cron. Missed runs catch up automatically.
Notifications
Alerts via Telegram, Slack, or Windows Toast.
Multi-Device
Manage multiple pfSense firewalls from one machine. Per-device config, credentials in OS keyring.
CLI-First
Rich terminal output with pfs status, pfs list, and pfs setup. Scriptable and automation-friendly.
Secure & Compressed
SSH key auth, SHA-256 verification, gzip compression with 70%+ size reduction. No secrets in config files.
Diff, Restore & Watch
Compare backups with unified diff. Restore to any path. Watch mode auto-backs up on config changes.
Up and running in minutes
Four steps from install to your first automated backup.
Install
pipx install pfsentinel
Same command on Linux and Windows (pip, pipx setup and other options). Or download the standalone binary:
Add your device
pfs device add
Interactive setup: host, username, password or SSH key, then confirm the SSH host key. Passwords are stored in the OS keyring.
Run your first backup
pfs backup runpfs backup run --all-extras
Config backup by default. Add --all-extras for RRD, certificates, DHCP, packages, and logs.
Schedule & notify
pfs schedule enable --daily-time 02:00pfs notify slack setup
Daily at 02:00 plus a weekly run, via the OS scheduler, with a notification after every run. Done.
Every command, option and recipe
The command manual covers install, scheduling on Linux and Windows, SSH keys, ZFS snapshots, notifications and restore. Or copy it with a ready prompt and ask your AI assistant.
See it in action
A clean CLI with rich terminal output for every operation.
$ pfs backup run --all-extras ℹ Saving backups to: ~/backups/pfsentinel ℹ Extras: all targets ℹ Backing up fw-primary (192.168.1.1)... [==============================] 100% Connected ✔ [config] config_20260403_143000.xml ✔ [rrd] extras_rrd_20260403_143000.tar.gz ✔ [certs] extras_certs_20260403_143000.tar.gz ✔ [dhcp] extras_dhcp_20260403_143000.tar.gz ℹ Saved to: ~/backups/pfsentinel/fw-primary/ ℹ Backing up fw-backup (192.168.1.2)... [==============================] 100% Connected ✔ [config] config_20260403_143005.xml ✔ [rrd] extras_rrd_20260403_143005.tar.gz ℹ Saved to: ~/backups/pfsentinel/fw-backup/ ✔ Total: 6 backup(s) across 2 device(s)
$ pfs status pfSentinel Status ───────────────────────────────────────────── Config: ~/.pfsentinel/config.json Backup dir: ~/backups/pfsentinel Devices ┏━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━┳━━━━━━━┓ ┃ Name ┃ Host ┃ Port ┃ User ┃ ┡━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━╇━━━━━━━┩ ┃ fw-primary ┃ 192.168.1.1 ┃ 22 ┃ admin ┃ ┃ fw-backup ┃ 192.168.1.2 ┃ 22 ┃ admin ┃ └──────────────┴───────────────┴──────┴───────┘ Total XML backups on disk: 47
Built securely, end to end
A backup tool holds the keys to your firewall. pfSentinel treats that seriously, from credential storage to the release pipeline.
Secrets stay in the keyring
Passwords and tokens live in Windows Credential Manager, GNOME Keyring or KWallet, or an AES-256-GCM encrypted store on headless boxes. Never in config files.
Pinned SSH host keys
New devices use strict host key checking. Confirm the fingerprint once with pfs device trust-key; a changed key is refused.
Hardened, fuzzed parsing
config.xml is parsed with entity resolution, DTDs and network access disabled, and covered by XXE tests and property-based fuzzing.
Reproducible CI with Dagger
The CI pipeline is built with Dagger, so the same containerized steps run locally and in GitHub Actions. Actions are pinned by commit SHA, dependencies are hash-locked, and releases ship SHA-256 checksums and Sigstore provenance.
Frequently asked questions
Everything you need to know before your first backup. More in the command manual.
How do I automatically back up my pfSense config?
Install pfSentinel with pip install pfsentinel, add the firewall with pfs device add, then run pfs schedule enable. pfSentinel then backs up config.xml every day at 02:00 and weekly on Sunday at 03:00 over SSH or HTTPS, using Windows Task Scheduler, systemd timers or cron, and keeps a new copy only when the config changed. Add more firewalls with pfs device add; every scheduled run backs up all of them.
Does pfSentinel store my pfSense password securely?
Yes. Passwords, SSH key passphrases and notification tokens are stored in the OS keyring (Windows Credential Manager, GNOME Keyring or KWallet), never in the config file. On headless Linux, WSL or containers without a keyring, pfSentinel uses its own AES-256-GCM encrypted file store. You can also skip passwords entirely with SSH key authentication.
Can pfSentinel run backups on a schedule on Linux and Windows?
Yes. pfs schedule enable registers Windows Task Scheduler tasks on Windows and systemd user timers on Linux, and falls back to cron where systemd is not available. On Linux, run loginctl enable-linger $USER once so backups also run while you are logged out. pfs schedule status shows the next run and the last result.
What does pfSentinel back up?
Every run backs up the pfSense XML configuration (config.xml). Over SSH it can also back up RRD graph data, package configs, DHCP leases, alias files, certificates, logs, ZFS snapshots and full filesystem archives. Every file gets a SHA-256 checksum.
Can pfSentinel back up pfSense with ZFS snapshots?
Yes. On pfSense 2.5 or later installed on ZFS, pfs backup snapshot -d <device> creates a snapshot on the firewall and streams it over SSH to local storage, incrementally after the first full run. UFS installs can use pfs backup archive to save a tar.gz of the critical directories instead.
How do I restore a pfSense config from a pfSentinel backup?
Run pfs backup restore <file> --target config.xml to extract the backup, then upload that file in the pfSense web UI under Diagnostics > Backup & Restore. pfSentinel never writes to the firewall itself, so a restore is always a deliberate manual step.
Is pfSentinel free, and does it send telemetry?
pfSentinel is free and open source under the Apache 2.0 license, with no paid tier. It has zero telemetry: backups and credentials stay on your machine, and it only connects to your firewall, the notification channels you set up, and GitHub Releases when you run pfs update.
How do I install pfSentinel on Windows or Linux?
Run pip install pfsentinel or pipx install pfsentinel with Python 3.13 or later, or download the standalone pfs.exe (Windows) or pfs (Linux) binary from GitHub Releases, which needs no Python. Then run pfs setup for a guided first-time setup. The full command manual is at pfs.nx1xlab.dev/docs.