diff --git a/crowdsec-docs/docs/getting_started/install_pfsense.md b/crowdsec-docs/docs/getting_started/install_pfsense.md index cda238096..d6f752123 100644 --- a/crowdsec-docs/docs/getting_started/install_pfsense.md +++ b/crowdsec-docs/docs/getting_started/install_pfsense.md @@ -3,257 +3,351 @@ id: install_crowdsec_pfsense title: pfSense --- -The CrowdSec package for pfSense requires some manual installation steps, as it is not yet available in the official repositories. +The CrowdSec package for pfSense is not yet in the official pfSense Package Manager, so +installation is done via a shell script. This page covers a verified, end-to-end installation +on **pfSense Plus 26.03 / FreeBSD 16** (CE 2.8.x on FreeBSD 14/15 also supported). Three types of setup are supported: -**Small** (remediation only) - the pfSense machine receives blocklists from a -Security Engine that you are running on a different machine. -Attacking traffic is blocked at the firewall by (configurable) pfSense rules. +**Small** (remediation only) — the pfSense machine receives blocklists from a Security Engine +running on a different machine. Attacking traffic is blocked at the firewall by pfSense rules. -**Medium** (small+log processor) - in addition to enforcing blocklists, the pfSense -machine can detect attacks directed at the firewall itself, for example port scans. -The data about the attacks is sent (for analysis and possibly sharing) to a Security Engine -that you are running on a different machine. +**Medium** (small + log processor) — in addition to enforcing blocklists, the pfSense machine +can detect attacks directed at the firewall itself (port scans, SSH brute-force, GUI brute-force). +Attack data is sent to a Security Engine running on a different machine. -**Large** (medium+LAPI) - deploy a fully autonomous Security Engine on the firewall -system and allow other Log Processors to connect to it. Requires a persistent `/var` -directory (no RAM disk) and a slightly larger pfSense machine, depending on the amount -of data to be processed. +**Large** (medium + LAPI) — deploy a fully autonomous Security Engine on the firewall and allow +other Log Processors to connect to it. Requires a persistent `/var` directory (no RAM disk) and +a slightly larger pfSense machine depending on the amount of data to process. If you are not already a CrowdSec user, the Large setup is the easiest: just leave the default -values to enable remediation, log processor and Local API. +values to enable Remediation, Log Processor and Local API. :::info The CrowdSec configuration is not transferred when you restore a pfSense backup, and you'll need -to reconfigure it or backup separately. Major pfSense upgrades may also require you to re-install -or re-configure CrowdSec so please verify that it's running afterwards. We have submitted the package -for inclusion in the official repository which should smooth out these issues. +to reconfigure it or back up separately. Major pfSense upgrades may also require you to re-install +or re-configure CrowdSec — verify it is running afterwards. ::: ## Installing the package - * Open an ssh connection to your pfSense box +Open an SSH connection to your pfSense box, then download and run the install script: - * Download the install script and run it: ```console # fetch https://raw.githubusercontent.com/crowdsecurity/pfSense-pkg-crowdsec/refs/heads/main/install-crowdsec.sh # sh install-crowdsec.sh ``` -* Do not activate or run the services yourself, because pfSense will take care of it. +The script is interactive and will ask three confirmations — answer **y** to each: -If you want to install a beta or an older version, please refer to [the release page](https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases) of the repository and provide the --release option to the install script. +1. A banner reminder to check the Package Manager first (the script is the correct path for now — answer y). +2. Confirmation to download the release archive from GitHub. +3. Confirmation to install the packages. - * Alternatively, you can download the packages to install in the `Assets` part of the release, and run the following commands in the right order. +By default the script fetches the **latest stable release** automatically. To pin to a specific +version (beta or older), pass `--release` with the tag from the [release page](https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases): + +```console +# sh install-crowdsec.sh --release v0.1.7-1.7.8-34 +``` + +:::note Release tag format +The tag encodes all three component versions: `v--`. +For example, `v0.1.7-1.7.8-34` means: +- `pfSense-pkg-crowdsec` **0.1.7** — the pfSense plugin +- `crowdsec` **1.7.8** — the Security Engine +- `crowdsec-firewall-bouncer` **0.0.34** — the `34` is the minor of `0.0.x` +::: + +When the script completes you will see: + +``` +# -------------- # +Installation complete. +You can configure and activate CrowdSec on your pfSense admin page (Package / Services: CrowdSec). +``` + +:::note +The packages print generic FreeBSD configuration instructions during installation. These can +be safely ignored on pfSense — the pfSense plugin manages configuration and service startup. +::: + +Alternatively, you can download packages manually from the `Assets` section of a release and +install them in dependency order: ```console -# setenv IGNORE_OSVERSION yes -# pkg add -f -# pkg add -f # pkg add -f # pkg add -f # pkg add -f ``` -The direct links are for the most popular Community Edition of pfSense, architecture amd64. If you run on ARM or a different base version -of FreeBSD, you will find .tar files in the release assets containing the packages for the possible platforms. +The direct links are for the Community Edition of pfSense, architecture amd64. For ARM or a +different FreeBSD base version, the release assets contain `.tar` archives with packages for +all supported platforms. ## Configuration -Once the package and its dependencies are installed, go to `Services/CrowdSec`. The options *Remediation Component*, -*Log Processor* and *Local API* should be enabled. Click Save. +After installation, **the services are not yet started**. You must save the configuration via +the pfSense web UI to activate CrowdSec. + +Go to `Services` → `CrowdSec`. The options *Remediation Component*, *Log Processor* and +*Local API* should be enabled by default. Click **Save**. ![Config part 1](/img/pfsense/config-1.png) -With the size analogy, the default is a "Large", autonomous installation. +The default is a "Large", autonomous installation. -For a "Medium", disable *Local API* and fill the fields in the *Remote LAPI* section. +For a "Medium" or "Small" setup, you need credentials from the remote LAPI machine first. -![Config part 2](/img/pfsense/config-2-remote.png) +### Medium and Small: pre-registering on the remote LAPI -For a "Small", disable *Log Processor* too. +Before saving the pfSense config, run the following on the **remote machine** running the LAPI: -CrowdSec on pfSense is fully functional from the command line but the web interface is read-only, with the exception of decision revocation (unban). -Most other actions require the shell or the [CrowdSec Console](https://app.crowdsec.net). -For simple things, `Diagnostics/Command Prompt` works as well as ssh. +```console +# For Medium (log processor + bouncer): +$ cscli machines add pfsense --auto -f - # outputs login + password to stdout +$ cscli bouncers add pfsense-firewall # outputs an API key -![Command Prompt](/img/pfsense/command-prompt.png) +# For Small (bouncer only): +$ cscli bouncers add pfsense-firewall # outputs an API key +``` + +Then in the pfSense GUI, disable *Local API* (and for Small, also *Log Processor*) and fill in the *Remote LAPI* section: +- **Remote LAPI URL** — e.g. `http://remote-address:8080/` +- **Login / Password** — from the `cscli machines add` output (Medium only) +- **Firewall bouncer API key** — from the `cscli bouncers add` output + +![Config part 2](/img/pfsense/config-2-remote.png) -You are free to edit the files in `/usr/local/etc/crowdsec`, although some setting may be overwritten by the pfSense package if they are mandatory. +For a "Small", also disable *Log Processor* — no machine registration is needed in that case, only the bouncer API key. :::caution -*Ram Disk*: unless you disable Local API, ensure that you are [not using a RAM disk](https://docs.netgate.com/pfsense/en/latest/config/advanced-misc.html#ram-disk-settings) -for the /var directory. The persistent CrowdSec database and GeoIP tables are in `/var/db`. -If you really need a RAM disk, you can still use the log processor and remediation but you will -need to connect them to a remote CrowdSec instance. +**RAM Disk**: unless you disable Local API, ensure you are [not using a RAM disk](https://docs.netgate.com/pfsense/en/latest/config/advanced-misc.html#ram-disk-settings) +for the `/var` directory. The persistent CrowdSec database and GeoIP tables are in `/var/db`. +If you need a RAM disk, you can still use the Log Processor and Remediation by connecting them +to a remote CrowdSec instance. ::: +The `Services` → `CrowdSec` configuration page lets you manage all key settings: enable/disable +each component, set log levels, configure LAPI connectivity, and control which interfaces the +firewall rules apply to. + +The **status and metrics pages are read-only**, with one exception: you can revoke individual +decisions (unban an IP) from `Status` → `CrowdSec Status`. + +For anything not exposed in the UI — hub management, acquiring new log sources, custom +scenarios — use the shell or the [CrowdSec Console](https://app.crowdsec.net). +`Diagnostics` → `Command Prompt` works as well as SSH for quick commands. + +![Command Prompt](/img/pfsense/command-prompt.png) + +You are free to edit the files in `/usr/local/etc/crowdsec`, although some settings may be +overwritten by the pfSense package if they are mandatory. + ## Service Status -In the page `Status/CrowdSec` you can see +In `Status` → `CrowdSec Status` you can see: - - registered log processors and remediation components +- Registered Log Processors and Remediation Components ![Remediation components](/img/pfsense/status-remediation-components.png) - - - installed hub items (collections, scenarios, parsers, postoverflows) +- Installed hub items (collections, scenarios, parsers, postoverflows) ![Hub collections](/img/pfsense/status-hub-collections.png) +- Alerts and local decisions - - alerts and local decisions - ![Alerts](/img/pfsense/status-alerts.png) +All tables are read-only with one exception: you can delete decisions one by one, to unban an +IP. An IP may have been banned for several reasons, which count as separate decisions. -All tables are read-only with an exception: you can delete decisions one by one, to unban an IP for example. -An IP may have been banned for several reasons, which counts as separate decisions. - -All hub objects are periodically upgraded with a cron job. +All hub items are periodically upgraded with a cron job. ## Detecting attacks If a Log Processor is running, the following scenarios are enabled by default: - - portscan - - ssh brute-force - - pfSense admin UI brute-force - - HTTP vulnerability probing +- Port scan detection (`firewallservices/pf-scan-multi_ports`) +- SSH brute-force (`crowdsecurity/ssh-bf`, `crowdsecurity/ssh-slow-bf`) +- pfSense admin UI brute-force (`crowdsecurity/pfsense-gui-bf`) +- HTTP vulnerability probing (via `crowdsecurity/base-http-scenarios` and `crowdsecurity/http-cve`) -These will trigger a ban on the attacking IP (4 hours by default) and report it to the CrowdSec Central API -(meaning [timestamp, scenario, attacking IP](https://docs.crowdsec.net/docs/concepts/), for inclusion in the -Community Blocklist. +These will trigger a ban on the attacking IP (4 hours by default) and report it to the CrowdSec +Central API for inclusion in the Community Blocklist. You can add scenarios to detect other types of attack on the pfSense server, or [connect several log processors](https://doc.crowdsec.net/docs/next/user_guides/multiserver_setup) -to the same LAPI node. -Other types of remediation are possible (ex. captcha test for scraping attempts). +to the same LAPI node. Other types of remediation are possible (e.g. captcha test for scraping +attempts). If disk space is not an issue, you can [increase the maximum size](https://docs.netgate.com/pfsense/en/latest/monitoring/logs/size.html) -of log files before they are compressed and rotated. This will help us in case you report -acquisition issues and we need to match the application behavior with the content of the acquired logs. +of log files before they are compressed and rotated. Larger log files help diagnostics when +you need to match application behavior with acquired log content. -We recommend you to [register to the Console](https://app.crowdsec.net/), especially if you protect several machines. +We recommend you [register to the Console](https://app.crowdsec.net/), especially if you +protect several machines. ## Processing logs -If a collection, parser or scenario can be applied to a software that you are running on pfSense, -you add it with `cscli collections install ...`, then you need to configure where CrowdSec will find the logs. +If a collection, parser, or scenario can be applied to software running on pfSense, add it +with `cscli collections install ...`, then configure where CrowdSec will find the logs. -New acquisition files should go in `/usr/local/etc/crowdsec/acquis.d/`. See `pfsense.yaml` for an example. -The option `poll_without_inotify: true` is required if the log sources are symlinks. -Make sure to reload or restart CrowdSec when you add new data sources. +New acquisition files should go in `/usr/local/etc/crowdsec/acquis.d/`. See `pfsense.yaml` +for an example. Two options are set in the default configuration: +- `poll_without_inotify: true` — required when log sources are symlinks. +- `force_inotify: true` — required to watch for directory and file creation (important when + `/var/log` is in RAM and log directories are created after CrowdSec starts). -## Diagnostics +Make sure to reload or restart CrowdSec when you add new data sources. -Under `Diagnostics/CrowdSec Metrics` you can check if the logs are acquired and the -events are triggered correctly. +:::note +Running `cscli metrics show acquisition` will typically show a high "unparsed" rate for +`/var/log/filter.log`. This is expected: CrowdSec only processes pf log entries relevant to +its scenarios (e.g. port scans). The majority of firewall log entries are intentionally not +parsed. +::: -![Diagnostics acquisition](/img/pfsense/diagnostic-metrics-acquisition.png) +## Diagnostics +Under `Diagnostics` → `CrowdSec Metrics` you can check if logs are acquired and events are +triggered correctly. +![Diagnostics acquisition](/img/pfsense/diagnostic-metrics-acquisition.png) ![Diagnostics local api](/img/pfsense/diagnostic-metrics-local-api.png) - - For real monitoring, you can fetch the same metrics with -[Prometheus](https://docs.crowdsec.net/docs/observability/prometheus/) (Grafana dashboard included) -Telegraf or your favorite solution. +[Prometheus](https://docs.crowdsec.net/docs/observability/prometheus/) (Grafana dashboard +included), Telegraf, or your preferred solution. -If you are not running a LAPI or a Log Processor, some metrics are always empty. +If you are not running a LAPI or a Log Processor, some metrics will always be empty. ## Logs -You can see the Security Engine logs in `Status/System Logs/Packages/crowdsec`. - +The Security Engine logs are visible in `Status` → `System Logs` → `Packages` → `crowdsec`. ![Logs](/img/pfsense/logs.png) -Other logs not shown in the UI are in `/var/log/crowdsec/crowdsec_api.log` -and `crowdsec-firewall-bouncer.log`. +Other logs not shown in the UI: +- `/var/log/crowdsec/crowdsec_api.log` — Local API log +- `/var/log/crowdsec/crowdsec-firewall-bouncer.log` — Firewall bouncer log +- `/var/log/crowdsec/crowdsec.log` — Security Engine log (also shown in the UI above) ## Service Management -Both services, Security Engine (crowdsec) and Remediation (crowdsec-firewall-bouncer) can be controlled from `Status/Services`. +Both services — Security Engine (`crowdsec`) and Remediation (`crowdsec-firewall-bouncer`) — +can be controlled from `Status` → `Services`. ![Services](/img/pfsense/status-services.png) +The equivalent shell commands are: + +```console +# service crowdsec start|stop|restart|status +# service crowdsec_firewall start|stop|restart|status +``` + +If the `service` command requires the `.sh` suffix (as in some pfSense contexts): + +```console +# service crowdsec.sh start|stop|restart +# service crowdsec_firewall.sh start|stop|restart +``` + +Note: the `.sh` form only supports `start`, `stop`, and `restart` — use the form without `.sh` +to check running status. -The equivalent shell commands are `service crowdsec.sh start/stop/restart` and `service crowdsec_firewall.sh start/stop/restart`. Note the ending **.sh**! ## Viewing blocked IPs -You can see the tables of the blocked IPs in `Diagnostics/Tables` +You can see the tables of blocked IPs in `Diagnostics` → `Tables`. ![Blocked IPs](/img/pfsense/blocked-ips.png) +Or from the shell: -Or from the shell, with the commands -`pfctl -T show -t crowdsec_blacklists` (IPv4) and `pfctl -T show -t crowdsec6_blacklists` (IPv6). +```console +# pfctl -T show -t crowdsec_blacklists # IPv4 +# pfctl -T show -t crowdsec6_blacklists # IPv6 +``` -To show the same data with more context, use `cscli decisions list -a`. +To show the same data with more context: -## Testing +```console +# cscli decisions list -a +``` -A quick way to test that everything is working correctly end-to-end is to -execute the following command. -Your ssh session should freeze and you should be kicked out from -the firewall. You will not be able to connect to it (from the same -IP address) for two minutes. +## Testing -It might be a good idea to have a secondary IP from which you can -connect, should anything go wrong. +A quick way to test that everything is working end-to-end is to ban your own IP address: ```console # cscli decisions add -t ban -d 2m -i -```` +``` + +Your SSH session should freeze and you should be kicked out from the firewall. You will not be +able to connect from the same IP address for two minutes. + +It might be a good idea to have a secondary IP from which you can connect, should anything go +wrong. + +You may need to disable the *Anti-lockout* rule in `System` → `Advanced` → `Admin Access` for +the duration of the test. -You may have to disable the *Anti-lockout* rule in -`System/Advanced/Admin Access` for the time of the test. +This is a safer way to test than attempting to brute-force yourself: the default ban period is +4 hours, and CrowdSec reads logs from the beginning, so it could ban you even if you failed +SSH login 10 times in 30 seconds two hours before installing it. -This is a more secure way to test than attempting to brute-force -yourself: the default ban period is 4 hours, and CrowdSec reads the -logs from the beginning, so it could ban you even if you failed ssh -login 10 times in 30 seconds two hours before installing it. +Note that the [Login Protection](https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html#login-protection) +service, which is enabled by default on pfSense, may trigger and block a brute-force attacker +before CrowdSec does, because it is more sensitive. Attacks not detected by Login Protection +will still be detected by CrowdSec and shared. If you need more CrowdSec tests you may want to +temporarily disable Login Protection depending on the scenario. -It must be noted that the [Login Protection](https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html#login-protection) service which is enabled by default on pfSense can be triggered - and block a brute force attacker - before CrowdSec does, because it's more sensitive. Still, some attacks that are not detected by Login Protection will be detected by CrowdSec and shared. -If you need more CrowdSec tests you may want to temporarily disable Login Protection, depending on the scenario. ## LAN / private networks whitelist -Since crowdsec 1.6.3, private IP networks are whitelisted by default as well. This means for example an IP from a LAN or WAN which is on 192.168.x.y won't get blocked by a local decision -(community blocklists don't contain private IPs). +Since CrowdSec 1.6.3, private IP networks are whitelisted by default. An IP from a LAN or WAN +in the `192.168.x.y` range will not be blocked by a local decision (community blocklists do not +contain private IPs). -If you want to revert to the previous behavior, to block private IPs as well, you can remove the related parser. +To revert to the previous behavior and allow blocking private IPs, remove the related parser: ```console -[root@OPNsense ~]# cscli parsers remove crowdsecurity/whitelists +# cscli parsers remove crowdsecurity/whitelists ``` -If on the other hand you upgrade from a version before 1.6.3, you need to install the lists yourself. +If you upgrade from a version before 1.6.3, you need to install the whitelist yourself: + +```console +# cscli parsers install crowdsecurity/whitelists +``` ## Uninstalling -In most cases, just remove the `crowdsec` package from -`System/Package Manager/Installed Packages`, or run the installation script with the --uninstall option. -This won't remove the database or configuration files, just in case -you want to reinstall CrowdSec later. +In most cases, remove the `crowdsec` package from `System` → `Package Manager` → `Installed +Packages`, or run the installation script with the `--uninstall` option: + +```console +# sh install-crowdsec.sh --uninstall +``` -If you need to make sure you removed all traces of CrowdSec, you can run the following commands: +This does not remove the database or configuration files, in case you want to reinstall later. + +To remove all traces of CrowdSec: ```console # pkg remove pfSense-pkg-crowdsec crowdsec crowdsec-firewall-bouncer @@ -261,6 +355,5 @@ If you need to make sure you removed all traces of CrowdSec, you can run the fol # rm -rf /var/db/crowdsec /var/log/crowdsec* /var/run/crowdsec* ``` -For testing purposes, you may want to remove the <crowdsec> section -from `/conf/config.xml` as well. - +For testing purposes, you may also want to remove the `` section from +`/conf/config.xml`. diff --git a/crowdsec-docs/unversioned/getting_started/installation/pfsense.mdx b/crowdsec-docs/unversioned/getting_started/installation/pfsense.mdx index da37e91b1..ba22c5098 100644 --- a/crowdsec-docs/unversioned/getting_started/installation/pfsense.mdx +++ b/crowdsec-docs/unversioned/getting_started/installation/pfsense.mdx @@ -9,6 +9,104 @@ pagination_next: getting_started/health_check New to CrowdSec? Start with the [introduction](/unversioned/getting_started/introduction.mdx) to understand the components and prerequisites. -The CrowdSec package for pfSense is not installed from the official repositories yet. +The CrowdSec package for pfSense is not yet in the official pfSense Package Manager. Installation +is done via a shell script that downloads and installs the packages from a GitHub release. -Follow the [detailed documentation](/docs/next/getting_started/install_crowdsec_pfsense) to install or update it from a release archive. +It deploys three packages: + +- `crowdsec` — the Security Engine and `cscli` CLI +- `crowdsec-firewall-bouncer` — the Remediation Component (blocks IPs via pfSense Packet Filter) +- `pfSense-pkg-crowdsec` — the pfSense plugin (web UI, service management) + +Do not start or configure services from the terminal — the pfSense plugin manages them for you. + +Three setup modes are supported: + +| Mode | Components | Use when | +|---|---|---| +| **Large** (default) | Remediation + Log Processor + Local API | Standalone, no existing CrowdSec instance | +| **Medium** | Remediation + Log Processor | pfSense reports attacks to a remote LAPI | +| **Small** | Remediation only | pfSense enforces blocklists from a remote LAPI | + +For **Medium** or **Small**, you must pre-register the pfSense machine on the remote LAPI before saving the pfSense config. Run these commands on the remote machine: + +```console +# Medium — register both the log processor and the bouncer: +$ cscli machines add pfsense --auto -f - # note the login + password printed to stdout +$ cscli bouncers add pfsense-firewall # note the API key + +# Small — register the bouncer only: +$ cscli bouncers add pfsense-firewall # note the API key +``` + +Then in `Services` → `CrowdSec`, disable *Local API* (and for Small, also *Log Processor*) and fill in the *Remote LAPI* section with the URL, credentials, and API key obtained above. + +:::caution +Unless you disable Local API, ensure you are **not using a RAM disk** for `/var` +(`System` → `Advanced` → `Misc` → `RAM Disk Settings`). The CrowdSec database and GeoIP +tables live in `/var/db/crowdsec` and would be lost on every reboot. +::: + +## Install the package + +Open an SSH connection to your pfSense box and run: + +```console +# fetch https://raw.githubusercontent.com/crowdsecurity/pfSense-pkg-crowdsec/refs/heads/main/install-crowdsec.sh +# sh install-crowdsec.sh +``` + +The script will ask three confirmations — answer **y** to each to proceed with the download and +installation. + +By default the script fetches the **latest stable release** automatically. To pin to a specific +version, pass `--release` with the tag from the [release page](https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases): + +```console +# sh install-crowdsec.sh --release v0.1.7-1.7.8-34 +``` + +:::note Release tag format +The tag encodes all three component versions: `v--`. +`v0.1.7-1.7.8-34` means `pfSense-pkg-crowdsec` **0.1.7**, `crowdsec` **1.7.8**, and `crowdsec-firewall-bouncer` **0.0.34** (the `34` is the minor of `0.0.x`). +::: + +When the script finishes you will see: + +``` +Installation complete. +You can configure and activate CrowdSec on your pfSense admin page (Package / Services: CrowdSec). +``` + +## Activate via the web UI + +After installation, **the services are not yet running**. Open the pfSense web UI: + +1. Go to `Services` → `CrowdSec`. +2. Verify that *Remediation Component*, *Log Processor*, and *Local API* are enabled (all on by default). +3. Click **Save**. + +Saving triggers the plugin to write configuration files, register the Security Engine and bouncer +with the local API, install the pfSense hub collection, and start both services. + +## Verify the installation + +From the pfSense shell or `Diagnostics` → `Command Prompt`: + +```console +# service crowdsec status # crowdsec is running as pid +# service crowdsec_firewall status # crowdsec_firewall is running as pid +# cscli lapi status # You can successfully interact with Local API (LAPI) +# cscli capi status # You can successfully interact with Central API (CAPI) +# cscli bouncers list # pfsense-firewall 127.0.0.1 ✔️ +``` + +You can also check service status in `Status` → `Services` and the full CrowdSec status +(registered agents, hub items, alerts, decisions) in `Status` → `CrowdSec Status`. + +## Next steps + +CrowdSec is now installed and protecting your pfSense box. Continue with the +[post-installation steps](/getting_started/next_steps.mdx) to finish setup, or read the +[full pfSense documentation](/docs/next/getting_started/install_crowdsec_pfsense) for +advanced configuration, diagnostics, log acquisition, and testing.