A complete setup as done on a two-port firewall, in the order that works:

1. the startup wizard (which port is the internet, which the local network);
2. VPN providers with failover;
3. pfSense aliases and rules;
4. a Wi-Fi network;
5. ad blocking for every device;
6. remote access to the LAN and the internet with WireGuard.

The screenshots are from a GMKtec NUC whose upstream is another firewall (pfSense) on 192.168.50.10. The administrator's PC is on the home network 192.168.2.0/24.

Every change waits in pending changes until you commit. Commit with the safety rollback on: if you lose the connection, the firewall undoes the change after five minutes. Press Keep these settings in the yellow banner once everything works.

Step 1: The startup wizard and the ports

Open System › Startup Wizard. The first step looks at what is connected to each port before you choose anything. For every port it checks:

• its link and its addresses;
• whether a DHCP server answers, and with which router;
• which devices answer on its network (ARP);
• whether the internet is reachable through it;
• whether your browser is connected through it (You are connected here).

It pre-selects the port that leads to the internet as WAN and the local network as LAN, and lists the reasons under Found.

The wizard then guards your connection:

• WAN by DHCP is offered only where a DHCP server answered. Where none answered, it suggests keeping the current static address and gateway.
• LAN on the port you are connected through: the address you use now is kept as a second address (Also keep … so this page stays reachable). You can confirm the change from the same page, and the new network works at once.
• The ports look the other way round, no port reaches the internet, or the LAN already has a router: a warning appears, each with a one-click fix.
• Hand out addresses on the LAN turns on the DHCP server for the new network, with the range filled in (for example 192.168.20.100–.199). It stays off where another router already hands out addresses on that port.

After Apply, the confirm screen shows whether the WAN got its address. Keep the settings only when it did.

If the ports are the wrong way round later: go to Network › Interfaces, zones & routes › Ports: WAN and LAN and press Detect what is connected. If it suggests so, press Swap WAN and LAN: addresses, zones, NAT, routes, and DHCP move with the roles. Commit with the safety rollback.

Name the firewall

The firewall's name shows under the Korthveil logo in the side menu, on every page, with the hardware it runs on. It is also the first word of the browser tab's title, so two firewalls (for example a failover pair) are easy to tell apart.

To change it, press the pencil next to the name, type the new name (letters, digits and hyphens, for example korthmain), and press Save to pending changes. It takes effect when you commit. The name also appears on the console screen, in alerts, reports and backups, and is announced to DHCP clients. In a failover pair each firewall keeps its own name.

On the command line: configure, set system hostname korthmain, commit (see The command line).

The bell: new and read

The bell in the top bar lists what needs attention now: alerts that are firing, and stopped services. The number on it counts only what you have not read yet.

• Mark all read clears the number. The check mark next to an item marks just that one. Opening an item also marks it read.
• Read items stay listed under Read (n) for as long as the problem lasts. The arrow next to one marks it new again.
• Read is only for you. Your choice is saved with your account, in every browser you use, and other administrators still see the alerts as new.
• If a problem goes away and comes back later, it shows as new again.
• To record for everyone that an alert is handled, open All alerts and history (Monitoring › Alerts) and press Acknowledge: the alert then shows seen by your name.

Step 2: VPN providers with failover

1. Import the configurations. Go to VPN › WireGuard › Import configuration and choose each provider's .conf file. Create new configurations for this firewall in each provider's account instead of reusing another device's: one key on two devices drops both connections. The keys stay inside the firewall and are never shown again.
2. Give every tunnel a zone. An imported tunnel has none, so it shows choose the zone the tunnel joins. Create a zone VPN (Network › Zones › Add zone, no management), then choose it on every tunnel.
3. Check "Public endpoint override". Your browser may autofill your user name into this empty field. Clear it.
4. Several servers of one provider. NordVPN gives every server the same tunnel address (10.5.0.2). That is fine: each provider tunnel uses only its own address, so you can import several NordVPN servers (and IPVanish servers) and put them in one failover group. Remove copies of the same server's file.
5. Save to pending changes.

Failover groups are set up under Network › Policy routing. Each group lists its tunnels in order, each with a monitor address pinged through the tunnel:

Policy routes send chosen devices or sites into a group, checked from top to bottom. The page shows each member's state live (up and its round trip, active on the one carrying traffic).

Step 3: pfSense aliases and rules

The quick way: System › Import from pfSense. On pfSense, download the configuration as XML (Diagnostics › Backup & Restore, without encryption), choose it here, map pfSense's interfaces to this firewall's (WAN, LAN, and the WireGuard tunnels), tick what to bring over, and import. Aliases, rules, gateway groups (with the kill switch where a group has no WAN), NAT, DHCP reservations, DNS host overrides, and pfBlockerNG lists arrive as pending changes, with a report of anything left out. The rest of this step explains what they become.

pfSense aliases become Firewall › Aliases (address and service objects), schedules Firewall › Schedules, and LAN rules Firewall › Rules. The full mapping is in the guide VPN failover with a kill switch, and moving pfSense rules to Korthveil.

Rules and routes that name devices by address apply to traffic that passes through this firewall. To try them while the old firewall still runs the network:

• keep the old network's address on the LAN port (the wizard's second address);
• set a device's gateway to this firewall's address on that network (here 192.168.2.13).

Only that device then uses the new rules and the VPN failover.

Step 4: A Wi-Fi network

Go to System › Wizards › New network:

1. Choose Trusted LAN as the purpose, then Wi-Fi.
2. Enter the name (SSID), band (5 GHz is faster, 2.4 GHz reaches further), and country, then type the Wi-Fi password yourself.
3. Choose the security: - WPA2/WPA3 (recommended): new devices use WPA3, older TVs and printers WPA2. - WPA3 only: switch to it once every device connects with WPA3. - Enterprise with certificates (NAC): one certificate per device, for the strongest control over your own devices.
4. Give the Wi-Fi its own network, for example 192.168.11.1/24.
5. Put it in the LAN zone so Wi-Fi devices get the LAN's rules and VPN routes.
6. Turn on DHCP for it under Network › DHCP server.

Step 5: Block ads and trackers for every device

Go to System › Wizards › DNS filtering and ad blocking:

1. Networks: the LAN (it includes the Wi-Fi).
2. Upstream: Quad9 over TLS: encrypted, and Quad9 also blocks malware domains.
3. Blocking: Block now, with the advertising, tracker, and malware lists. Use Monitor first to see what would be blocked before you switch.
4. Devices: turn on all three: - DHCP gives devices this firewall as their DNS; - DNS sent to other servers (8.8.8.8 and the like) is redirected here; - private DNS over TLS and QUIC (port 853) is blocked, so phones cannot go around the filter.
5. Review and apply.

The lists download right after; Download lists now on Security › Ad & tracker blocking starts it at once. Names on the lists shows how many are blocked: here about 84,000.

DNS over HTTPS inside a browser cannot be stopped this way. Turn it off in the browser's settings, or use a managed browser policy.

Step 6: Remote access to the LAN and the internet (WireGuard)

Phones and laptops away from home connect to the firewall with the WireGuard app and then reach the LAN and the internet as if they were at home, with the firewall's ad blocking.

1. Give the firewall a name the internet can find. Under Network › Dynamic DNS, keep a DNS name pointed at your public address (here cap.publicvm.com, updated through DNSExit: choose the provider DNSExit and paste the DNSExit API key; older setups with a custom update URL keep working).
2. Go to VPN › WireGuard. Under Remote access endpoint, enter that name. It is written into every device configuration.
3. Type a name for the tunnel (here wg1) next to New tunnel and press it. The firewall makes the key pair and picks a private tunnel network for IPv4 and IPv6 (here 10.249.0.1/24 and a fd…::/64).
4. Set: - Role: Server (devices and sites connect here); - Listen port: a port no other tunnel uses (here 51821; the provider tunnels need none); - Zone: LAN, so remote devices get the LAN's rules: the local network and the internet; - Accept connections from zones: WAN only.
5. Save to pending changes, then commit with the safety rollback and Keep these settings. The existing outbound NAT on the WAN covers the new tunnel network, so the internet works without another NAT rule.
6. Add each device: under Remote devices, press Add device, give it a name, and scan the QR code with the WireGuard app (or download the .conf for a laptop). The device's private key is shown only this once and is not kept on the firewall.

Behind another router (as here, behind pfSense): the router must forward the port to the firewall's WAN address. On pfSense: Firewall › NAT › Port Forward › Add: interface WAN, protocol UDP, destination WAN address port 51821, redirect target 192.168.50.1 port 51821, with Add associated filter rule. Once Korthveil is the main firewall with the public address, no forward is needed.

Test it from outside your network: turn off the phone's Wi-Fi, switch the tunnel on in the app, and open a LAN address and any website. VPN › WireGuard › Tunnel status shows the device online with its last handshake.

Tip: Select all and Unselect all

Every list with more than five choices has Select all and Unselect all (and tables have a checkbox in the header that ticks or clears every row). Where a list has a search box, they change only the rows you see. Locked choices are left alone. As always, the change goes into the pending changes.

Check it