Skip to content
Get packs

Guide · Agent skill

How to use the Configuring pfSense Firewall Rules agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the configuring-pfsense-firewall-rules agent skill, a playbook that lets an AI agent help you build and change rules on a pfSense firewall. It is written for readers who have never used agent skills. By the end you will know what the skill does, how to add it to your agent, how to ask for help in plain language, and what to check before anything touches a live device.

Configuring pfSense Firewall Rulesmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it so the folder contains SKILL.md, scripts/agent.py and references/api-reference.md.
  2. 2Place it where your agent looks. Move the folder to ~/.claude/skills/ for personal use or to .claude/skills/ inside a project. Or upload it in the Claude apps under Settings → Capabilities → Skills.
  3. 3Check the requirements. Confirm pfSense 2.7+ with at least two interfaces, WebConfigurator access, and, for the API script, Python 3 with requests and the pfsense-api package.
  4. 4Ask for a plan in plain language. Describe your zones, services and traffic rules, and ask the agent for a plan that you can review before any change.
  5. 5Audit before changing. Run the API script with --audit-only against your device to see current rules without modifying them.
  6. 6Apply and test in a window. Back up the XML configuration, apply changes during a planned window, then test access from each zone.

What is an agent skill and what does this one do?

An agent skill is a folder of instructions and optional scripts that an AI agent can load when a task matches its description. This skill is licensed under Apache-2.0 and is aimed at pfSense, an open-source router and firewall appliance.

Once installed, the agent can draft network zone layouts for DMZ, internal, guest and IoT networks, write firewall allow and deny rules, configure port-forwarding NAT, plan IPsec or OpenVPN tunnels, and set bandwidth policies. A bundled Python script can also push changes to a pfSense box through its REST API, so the agent can act on a live device rather than only writing instructions.

  • Zone design: VLAN and interface layout for DMZ, servers, guest and IoT segments
  • Firewall rules: aliases and allow or block rules per zone, with an explicit default deny for DMZ
  • NAT: port-forward rules and outbound NAT for dedicated public IPs
  • VPNs: IPsec or OpenVPN site-to-site and remote-access tunnels
  • Traffic shaping: bandwidth and QoS policies
  • Audit: the API script can audit existing rules for overly permissive or undocumented entries

How do you install the skill?

Download the ZIP file from this page and unzip it. For a personal install, place the folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

The folder should contain SKILL.md, scripts/agent.py and references/api-reference.md. Keep these files together so the agent can read the instructions and the script.

  • Personal install: ~/.claude/skills/configuring-pfsense-firewall-rules/
  • Project install: .claude/skills/configuring-pfsense-firewall-rules/ inside your project
  • Claude apps: Settings → Capabilities → Skills, then upload the skill
~/.claude/skills/configuring-pfsense-firewall-rules/

What do you need before you start?

The skill assumes a working pfSense system. The source lists pfSense 2.7 or later on dedicated hardware or a virtual machine with at least two network interfaces. You also need access to the pfSense WebConfigurator, which the source gives as https://192.168.1.1 by default.

For the API script you also need Python 3 with the requests library (version 2.28 or later, per the API reference) and the pfsense-api package installed on pfSense, with an API key and secret created in the WebConfigurator. Plan your topology, DNS and DHCP for each zone before asking for changes.

  • pfSense 2.7+ on hardware or a VM with at least two interfaces
  • Access to the WebConfigurator (default https://192.168.1.1)
  • A topology diagram showing interfaces, VLANs and intended traffic flow
  • Python 3 with requests (>=2.28) for the API script
  • pfsense-api package with API key and secret
  • Basic understanding of TCP/IP, NAT and stateful firewalls

How do you trigger the skill with natural requests?

You do not need special syntax. Describe the outcome you want in plain language and mention pfSense. The agent matches the request against the skill description, which covers firewall rules, NAT, IPsec or OpenVPN tunnels, traffic shaping, zone segmentation, DMZ, guest and IoT networks.

Be specific about zones and ports, and say whether you want a plan or a live change. Asking for a plan first is the safer default.

  • "Draft pfSense rules that keep IoT devices from reaching the LAN and allow only HTTPS and MQTT to the cloud."
  • "Set up port forwarding on pfSense so HTTPS on WAN reaches my DMZ web server at 10.10.10.50."
  • "Audit the existing pfSense rules and list any that allow any-to-any traffic."
  • "Plan an IPsec site-to-site tunnel between two pfSense boxes. Do not apply anything yet."

What does a typical segmentation setup look like?

The skill's workflow builds a perimeter in stages. It defines interfaces and VLANs, then DHCP and DNS per zone, then reusable aliases such as RFC1918 networks, web ports and critical servers. Rules are written per zone, followed by NAT, logging and testing.

The example addressing uses 10.10.x.0/24 networks for CORPORATE_LAN, DMZ, SERVERS, GUEST and IOT. These values are illustrative. Replace them with your own plan. The guest zone in the example uses public DNS only, and DNS Resolver is enabled on all interfaces except GUEST.

  • Interfaces and VLANs: WAN on igb0, LAN on igb1, and VLANs 10, 20, 30 and 40 for DMZ, SERVERS, GUEST and IOT
  • Aliases: RFC1918_Networks, WebPorts, ManagementPorts, CriticalServers
  • Rules: per-zone pass and block rules, with blocks placed before broader allows where needed
  • Logging: remote syslog and logging on block and critical pass rules

What are the safety notes for scripts and the network?

This skill runs scripts and uses the network. The bundled agent.py script connects to your pfSense URL with an API key and secret, so only run it against devices you own and manage, and keep the key and secret out of shared files. Use --audit-only first to see current rules without changing anything.

The example rules and IP ranges are illustrative. A wrong rule can cut off access or expose services. The skill itself says it should not be your sole control and should not replace host-based firewalls or IDS/IPS. Test changes in a lab or during a planned change window, and export a configuration backup before applying changes. The source includes a backup step using Diagnostics > Backup & Restore.

  • Read the plan before approving any change
  • Start with --audit-only
  • Keep a current XML configuration backup
  • Test each zone after changes (for example, curl from LAN to SERVERS and LAN to IOT)
  • Do not use it on production firewalls without a tested change plan
python agent.py --url https://192.168.1.1 --api-key <key> --api-secret <secret> --audit-only

What tips help the results go smoothly?

Give the agent your interface names, zone subnets and the services that must stay reachable. The more concrete the topology, the fewer invented assumptions appear in the output. Ask for a test plan with every rule set so you can verify behaviour from each zone.

Use aliases for repeated networks and ports so rules stay readable. Keep descriptions on every rule, because the API audit flags undocumented entries. Review the NAT and rule order together, since a block placed after a broad allow may never be reached.

  • Name your interfaces and zones before asking for rules
  • Ask for a plan, then a dry review, then the live change
  • Request a rollback note with each change
  • Document each rule with a description

What people use it for

  • Designing a DMZ with a public web server and an internal DNS server that the DMZ can query
  • Isolating guest Wi-Fi so guests reach the internet on DNS and web ports but not internal networks
  • Blocking IoT lateral movement while allowing only HTTPS and MQTT to cloud endpoints
  • Setting up a port forward for an SSH jump host on a non-standard WAN port
  • Auditing an existing pfSense rule set for overly permissive or undocumented rules

Frequently asked questions

Is the configuring pfSense firewall rules skill free?

The skill is licensed under Apache-2.0, as listed on this page. Check the license file in the downloaded ZIP for the full terms. This page does not state any price.

What do I need to use this agent skill?

You need pfSense 2.7 or later on hardware or a VM with at least two interfaces, and access to the WebConfigurator. For the API script you also need Python 3, the requests library, and the pfsense-api package with an API key and secret.

Where do I install the skill?

Put the folder in ~/.claude/skills/ for personal use or in .claude/skills/ inside a project. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

Can the agent change my pfSense firewall directly?

The bundled agent.py script can send changes through the pfSense REST API, so it can act on a live device. Start with the --audit-only option and review any plan before running changes.

Is this skill safe for production firewalls?

Only after a tested change plan. The example rules and IP ranges are illustrative, and a wrong rule can cut off access or expose services. The skill also says it should not be the sole security control.

What are the alternatives if this does not fit my firewall?

The steps are specific to pfSense menus and the pfsense-api package, so this skill does not apply to non-pfSense firewalls. For those, use that vendor's documentation or a skill written for that platform.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits network engineers, IT admins, students and security teams who want a structured pfSense segmentation playbook and an agent that can audit or apply changes through the API. It is a poor fit for production firewalls without a tested change plan, for host-based protection or IDS/IPS replacement, and for non-pfSense devices.

Download the skill