pfSentinel
Automated pfSense backup — config, RRD, certificates, ZFS snapshots, and more.
SSH & HTTPS. Windows & Linux (tested on Ubuntu). Zero telemetry. 100% local.
$ pip install pfsentinel
Available on PyPI · GitHub · Releases
Platforms
Everything you need to protect your firewall config
Back up everything — config, RRD, certificates, ZFS snapshots — with scheduling, notifications, and change detection built in.
9 Backup Targets
XML config, RRD graphs, package configs, DHCP leases, aliases, certificates, logs, ZFS snapshots, and filesystem archives.
SSH & HTTPS
Dual-protocol support. SSH via Paramiko with key auth, HTTPS with automatic CSRF handling.
Change Detection
Classifies config changes: interfaces, firewall rules, system, users, VPN, DHCP, and packages.
Scheduled Backups
Daily or weekly automated backups via native OS scheduler on Windows and Linux.
Notifications
Alerts via Telegram, Slack, or Windows Toast.
Multi-Device
Manage multiple pfSense firewalls from one machine. Per-device config, credentials in OS keyring.
CLI-First
Rich terminal output with pfs status, pfs list, and pfs setup. Scriptable and automation-friendly.
Secure & Compressed
SSH key auth, SHA-256 verification, gzip compression with 70%+ size reduction. No secrets in config files.
Diff, Restore & Watch
Compare backups with unified diff. Restore to any path. Watch mode auto-backs up on config changes.
Up and running in minutes
Four steps from install to your first automated backup.
Add your device
pfs device add
Interactive setup — enter hostname, IP, and credentials. Passwords stored in OS keyring.
Run your first backup
pfs backup runpfs backup run --all-extras
Config backup by default. Add --all-extras for RRD, certificates, DHCP, packages, and logs.
Schedule & notify
pfs schedule enable --interval dailypfs notify slack setup
Automate backups and get notified on every run. Done.
See it in action
A clean CLI with rich terminal output for every operation.
$ pfs backup run --all-extras ℹ Saving backups to: ~/backups/pfsentinel ℹ Extras: all targets ℹ Backing up fw-primary (192.168.1.1)... [==============================] 100% Connected ✔ [config] config_20260403_143000.xml ✔ [rrd] extras_rrd_20260403_143000.tar.gz ✔ [certs] extras_certs_20260403_143000.tar.gz ✔ [dhcp] extras_dhcp_20260403_143000.tar.gz ℹ Saved to: ~/backups/pfsentinel/fw-primary/ ℹ Backing up fw-backup (192.168.1.2)... [==============================] 100% Connected ✔ [config] config_20260403_143005.xml ✔ [rrd] extras_rrd_20260403_143005.tar.gz ℹ Saved to: ~/backups/pfsentinel/fw-backup/ ✔ Total: 6 backup(s) across 2 device(s)
$ pfs status pfSentinel Status ───────────────────────────────────────────── Config: ~/.config/pfsentinel/devices.yaml Backup dir: ~/backups/pfsentinel Devices ┏━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━┳━━━━━━━┓ ┃ Name ┃ Host ┃ Port ┃ User ┃ ┡━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━╇━━━━━━━┩ ┃ fw-primary ┃ 192.168.1.1 ┃ 22 ┃ admin ┃ ┃ fw-backup ┃ 192.168.1.2 ┃ 22 ┃ admin ┃ └──────────────┴───────────────┴──────┴───────┘ Total XML backups on disk: 47
Frequently asked questions
Everything you need to know before your first backup.
Is pfSentinel free?
Yes. pfSentinel is free and open-source software released under the Apache 2.0 license. There is no paid tier, license fee, or subscription.
Does pfSentinel send any telemetry or data externally?
No. pfSentinel has zero telemetry and runs 100% locally. Backups stay on your machine and credentials are stored in your OS keyring — nothing is sent to any external service.
What does pfSentinel back up?
Nine targets: the XML configuration, RRD graph data, package configs, DHCP leases, aliases, certificates, logs, ZFS snapshots, and full filesystem archives.
What are the system requirements?
Python 3.13+ on Windows or Linux (tested on Ubuntu). Your pfSense firewall must be reachable over SSH or HTTPS. A standalone binary is also available with no Python required.
How do I install pfSentinel?
Install from PyPI with pip install pfsentinel, or download the standalone pfs.exe (Windows) or pfs (Linux) binary from GitHub Releases.
Can pfSentinel back up multiple pfSense firewalls?
Yes. pfSentinel manages multiple pfSense devices from one machine, with per-device configuration and credentials stored securely in the OS keyring.