# pfSense - Local System Config Backup and send to S3 Buckets
To automate backing up your pfSense configuration to Amazon S3, you can use pfSense's built-in **`rclone` package**. This eliminates the need for complex custom shell scripts because `rclone` can natively authenticate with AWS S3 and encrypt your files.
Here is the step-by-step guide to setting it up.
Step 1: Install the Required Packages
pfSense does not include backup utilities or cron management by default. You need to install them from the Package Manager. [[1](https://www.youtube.com/watch?v=06bsVIwTHbk)]
1. Log into your pfSense WebGUI. 2. Navigate to **System** > **Package Manager** > **Available Packages**. 3. Search for and install **`rclone`**. 4. Search for and install **`cron`** (this gives you a visual interface to schedule the backup).
### Step 2: Configure Rclone for Amazon S3
Next, create a connection profile (called a "remote") between your pfSense box and your S3 bucket.
1. Connect to your pfSense firewall via **SSH** (or use the WebGUI via **Diagnostics** > **Command Prompt**). 2. Run the rclone configuration tool:```bash rclone config ```
3. Type **`n`** for "New remote" and name it **`s3-backup`**. 4. When prompted for the storage type, type **`s3`** (or look for the number corresponding to Amazon S3). 5. Choose your S3 provider by typing **`Amazon`** (or press enter for the default AWS S3). 6. Select **`false`** for entering AWS credentials from the env\_auth. 7. Enter your AWS account details when prompted: - **`access_key_id`**: *Your AWS Access Key* - **`secret_access_key`**: *Your AWS Secret Key* 8. Select your AWS Region (e.g., `us-east-1`). 9. For all other advanced settings (endpoint, ACLs, encryption), you can press **Enter** to accept the defaults. 10. Type **`y`** to confirm and save the configuration, then **`q`** to quit. Optional if `rclone` is not available and install `rclone` Manually
#### 1. Download and Extract the Binary
SSH into your pfSense box (or use **Diagnostics** > **Command Prompt**) and execute these commands to download the FreeBSD version of Rclone:
```bash # 1. Navigate to a temporary folder cd /tmp # 2. Download the official FreeBSD 64-bit binary zip archive fetch https://downloads.rclone.org/v1.75.0/rclone-v1.75.0-freebsd-amd64.zip # 3. Unzip the downloaded archive tar -xf rclone-current-freebsd-amd64.zip ``` #### 2. Move `rclone` to the System Path
Move the extracted binary file into the folder where pfSense looks for standard utilities:
```bash # 1. Move the executable binary into your local execution path mv /tmp/rclone-*-freebsd-amd64/rclone /usr/local/bin/ # 2. Grant execution permissions to the binary file chmod +x /usr/local/bin/rclone # 3. Clean up the leftover installation files from /tmp rm -rf /tmp/rclone-* ``` #### 3. Verify the Installation
Run the version check command to verify it executes perfectly:
bash
```bash rclone version ``` ### Step 3: Create the Backup Script on pfSense
pfSense stores its active configuration file at `/conf/config.xml`. We will write a simple 3-line script to copy this file, timestamp it, and upload it.
1. In the WebGUI, go to **Diagnostics** > **Command Prompt**. 2. In the **Execute Shell Command** box, run this command to create a backup directory:
bash
```bash mkdir -p /root/backups ```
3. Go to **Diagnostics** > **Edit File**. 4. In the **Path to file to edit** box, type: `/root/backup_pfsense.sh` and click **Load**. 5. Paste the following script into the text area:
bash
```bash #!/bin/sh DATE=$(date +%Y%m%d-%H%M%S) BACKUP_FILE="/root/backups/pfsense-config-${DATE}.xml" # 1. Copy the live config to the local backup folder cp /conf/config.xml "${BACKUP_FILE}" # 2. Push the file to your S3 bucket (replace "your-bucket-name" with your actual bucket) /usr/local/bin/rclone copy "${BACKUP_FILE}" s3-backup:your-bucket-name/pfsense/ # 3. Clean up local files older than 7 days to save space on pfSense find /root/backups/ -name "pfsense-config-*.xml" -type f -mtime +7 -delete ```
6. Click **Save**. 7. Go back to **Diagnostics** > **Command Prompt** and make the script executable by running:
bash
```bash chmod +x /root/backup_pfsense.sh ```
*(Optional Testing: You can test if it works right now by running `/root/backup_pfsense.sh` in the Command Prompt box and checking your S3 bucket).*
Step 4: Schedule the Automation with Cron
Now, use the Cron package you installed in Step 1 to make this run automatically every day.
1. Navigate to **Services** > **Cron** in the WebGUI. \[[1](https://opennix.org/en/docs/pfsense/development/pfsense-custom-scripts/)\] 2. Click **+ Add** to create a new cron job. 3. Configure the schedule (e.g., to run daily at 3:00 AM): - **Minute**: `0` - **Hour**: `3` - **Day of the Month**: `*` - **Month**: `*` - **Day of the Week**: `*` - **User**: `root` - **Command**: `/root/backup_pfsense.sh` 4. Click **Save**.
🔒 Security Warning for pfSense Backups
Your `config.xml` file contains your firewall's root password hashes, VPN private keys, and network topology.
- **Encrypt the Remote Bucket:** Ensure your S3 bucket has Server-Side Encryption (SSE) turned on. - **Alternative (Rclone Encryption):** If you want absolute zero-knowledge security, you can run `rclone config` again, add a new remote of type **`crypt`**, and point it at `s3-backup:your-bucket-name`. This will encrypt the file locally on pfSense *before* it touches AWS infrastructure.