Python CLI

pfSentinel

Automated pfSense backup — config, RRD, certificates, ZFS snapshots, and more.
SSH & HTTPS. Windows & Linux (tested on Ubuntu). Zero telemetry. 100% local.

Terminal

$ pip install pfsentinel

Available on PyPI · GitHub · Releases

View on GitHub Get Started

v0.1.0 Latest

Apache 2.0 License

Python 3.13+ Requires

Platforms

Everything you need to protect your firewall config

Back up everything — config, RRD, certificates, ZFS snapshots — with scheduling, notifications, and change detection built in.

9 Backup Targets

XML config, RRD graphs, package configs, DHCP leases, aliases, certificates, logs, ZFS snapshots, and filesystem archives.

SSH & HTTPS

Dual-protocol support. SSH via Paramiko with key auth, HTTPS with automatic CSRF handling.

Change Detection

Classifies config changes: interfaces, firewall rules, system, users, VPN, DHCP, and packages.

Scheduled Backups

Daily or weekly automated backups via native OS scheduler on Windows and Linux.

Notifications

Alerts via Telegram, Slack, or Windows Toast.

Multi-Device

Manage multiple pfSense firewalls from one machine. Per-device config, credentials in OS keyring.

CLI-First

Rich terminal output with pfs status, pfs list, and pfs setup. Scriptable and automation-friendly.

Secure & Compressed

SSH key auth, SHA-256 verification, gzip compression with 70%+ size reduction. No secrets in config files.

Diff, Restore & Watch

Compare backups with unified diff. Restore to any path. Watch mode auto-backs up on config changes.

Up and running in minutes

Four steps from install to your first automated backup.

Install

pip install pfsentinel

or download the standalone binary:

Windows pfs.exe

Linux pfs

Add your device

pfs device add

Interactive setup — enter hostname, IP, and credentials. Passwords stored in OS keyring.

Run your first backup

                            pfs backup run

                            pfs backup run --all-extras

Config backup by default. Add --all-extras for RRD, certificates, DHCP, packages, and logs.

Schedule & notify

                            pfs schedule enable --interval daily

                            pfs notify slack setup

Automate backups and get notified on every run. Done.

See it in action

A clean CLI with rich terminal output for every operation.

pfs backup run --all-extras

$ pfs backup run --all-extras
  ℹ Saving backups to: ~/backups/pfsentinel
  ℹ   Extras: all targets
  ℹ Backing up fw-primary (192.168.1.1)...
  [==============================] 100% Connected
  ✔ [config] config_20260403_143000.xml
  ✔ [rrd]    extras_rrd_20260403_143000.tar.gz
  ✔ [certs]  extras_certs_20260403_143000.tar.gz
  ✔ [dhcp]   extras_dhcp_20260403_143000.tar.gz
  ℹ   Saved to: ~/backups/pfsentinel/fw-primary/
  ℹ Backing up fw-backup (192.168.1.2)...
  [==============================] 100% Connected
  ✔ [config] config_20260403_143005.xml
  ✔ [rrd]    extras_rrd_20260403_143005.tar.gz
  ℹ   Saved to: ~/backups/pfsentinel/fw-backup/
  ✔ Total: 6 backup(s) across 2 device(s)

pfs status

$ pfs status

  pfSentinel Status
  ─────────────────────────────────────────────

  Config:     ~/.config/pfsentinel/devices.yaml
  Backup dir: ~/backups/pfsentinel

                  Devices
  ┏━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━┳━━━━━━━┓
  ┃ Name         ┃ Host          ┃ Port ┃ User  ┃
  ┡━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━╇━━━━━━━┩
  ┃ fw-primary ┃ 192.168.1.1   ┃   22 ┃ admin ┃
  ┃ fw-backup  ┃ 192.168.1.2   ┃   22 ┃ admin ┃
  └──────────────┴───────────────┴──────┴───────┘

  Total XML backups on disk: 47