When you first power up a fresh installation of open-source firewall software, you'll need the factory credentials to access the web configurator. The standard factory default username is admin and the default password is pfsense. If you're connecting via SSH or the console command line for backend administration, the default root account username is root with that same initial password, though modern versions prompt you to secure these credentials immediately upon your first login.
Knowing these credentials is only the first step. If you've locked yourself out, inherited a pre-configured box, or need to secure a fresh deployment against unauthorized network scans, you'll need a clear strategy. Let's break down how to log in, handle modern version security updates, fix lockout scenarios, and lock down your firewall configuration.
Initial Login and Version Differences
Getting into a newly flashed firewall depends heavily on whether you're running community edition software or recent builds of pfSense Plus. By default, the device assigns an internal IP address—usually 192.168.1.1—to its LAN interface. Plug an Ethernet cable from your workstation into the designated LAN port, configure your computer's network settings to pull an IP via DHCP or assign yourself a static address in that same subnet, and open your browser.
Navigate to [https://192.168.1.1](https://192.168.1.1). Your browser will throw a security warning because the firewall uses a self-signed SSL certificate by default. This is normal and expected for a fresh local install. Bypass the warning by clicking "Advanced" and proceeding to the site.
When the login prompt appears, type in the username admin and the password pfsense.
Things have changed slightly on newer hardware appliances and software updates. Starting with pfSense Plus version 24.03, Netgate introduced a mandatory password change on first boot. You won't just log in and sit on the dashboard anymore; the system forces you to pick a unique, secure password right away to prevent insecure devices from sitting on local networks unprotected.
Accessing the Command Line and SSH
Web interfaces are great for daily rule management, but troubleshooting deep network issues often requires the console or SSH. If you plug a monitor and keyboard directly into your hardware appliance, you'll see a text-based console menu with options ranging from interface assignment to factory resets.
For SSH access, you must first enable the secure shell service inside the web GUI under system settings. Once enabled, you can connect from your terminal using the root username and your current administrator password.
Keep a close eye on user privileges. Changing the password in the web GUI updates it for administrative web tasks, but you'll want to ensure your SSH keys or administrative group mappings are correct if you manage multiple system operators. Avoid sharing the root account across multiple team members; instead, create individual user accounts with specific administrative roles under the user manager settings.
What to Do If You Lock Yourself Out
Lockouts happen. Whether you forgot the custom password you set during installation or inherited a box with unknown credentials, you aren't out of luck. You don't necessarily have to reflash the entire drive, but you will need physical or console access to the machine.
Connect a monitor and keyboard directly to the firewall, or plug into the serial console port. Reboot the device. As the system boots up, you'll see a boot loader menu with a countdown timer. Press 4 to boot into Single User Mode.
Once the system boots into single-user mode, you'll be greeted by a prompt. Run the filesystem mount command to make the drive writable:
sbin/mount -u /
Next, run the recovery utility script designed specifically to reset the configuration and restore factory defaults without wiping your entire disk layout:
etc/rc.initial.password
This utility resets the web GUI administrator account back to the factory default username admin and password pfsense. Once the script finishes, reboot the firewall normally. Log back into the web GUI using those default credentials, and immediately assign a new, robust password.
Hardening Your Firewall After First Login
Leaving default settings intact is one of the easiest ways to compromise a network perimeter. Attackers routinely scan public-facing or misconfigured local networks for default administrative portals.
Start by changing the admin password to something long, random, and stored safely in a password manager. Next, disable password authentication for SSH where possible, opting instead for cryptographic SSH keys.
Consider changing the default listening port for the web configurator if your interface faces a less-trusted internal network segment. By default, the web GUI listens on HTTPS port 443. Shifting this to a non-standard port reduces log noise from automated bot scanners.
Finally, enable multi-factor authentication for your administrative accounts. pfSense supports Time-based One-Time Passwords (TOTP) compatible with standard authenticator applications. Setting this up ensures that even if a password leaks, unauthorized users can't breach your perimeter gateway.
Frequently Asked Questions
Why won't my browser load the 192.168.1.1 login page?
If your computer's local network interface isn't receiving an IP address from the firewall's DHCP server, you won't reach the page. Try setting a static IP on your computer like 192.168.1.100 with a subnet mask of 255.255.255.0 and a gateway of 192.168.1.1. Also ensure you're plugged into the physical port labeled LAN, not WAN.
Does changing the admin password change the SSH password?
Yes. The local database ties the administrative web GUI credentials to the backend system credentials. When you update the password for the primary admin user, the root and admin backend access credentials shift to match.
Can I recover a forgotten password without physical access?
No. For security reasons, you cannot reset administrative credentials remotely unless you already have an active SSH session with root privileges or another secondary admin account with user management rights. Physical or console access is required to trigger single-user recovery mode.
What should I do if my factory reset script fails?
If filesystem corruption prevents the password reset script from executing cleanly, you can perform a complete factory reset by reinstalling the software from a USB installer image or restoring a known-good configuration backup file if you have one saved externally. Check out the official Netgate Documentation for detailed re-imaging guides.
