pfsense

package
v1.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 3, 2026 License: Apache-2.0 Imports: 5 Imported by: 0

README

pfSense Configuration Schema

This package defines Go structs for parsing pfSense config.xml files. It follows the copy-on-write pattern described in AGENTS.md: reuse OPNsense types where XML structures are identical, fork locally at first divergence.

Config Versions

pfSense CE Plus Config Rev FreeBSD
2.5.x 21.02 21.4-21.7 12.2-STABLE
2.6.0 22.01 22.2 12.3-STABLE
2.7.0 23.05 22.9 14.0-CURRENT
2.8.0 25.07 24.0 15.0-CURRENT

CE and Plus share the same config format at corresponding releases. Config upgrades are sequential, handled by upgrade_NNN_to_NNN() functions in the pfSense source (upgrade_config.inc).

Root Element

The root XML element is <pfsense> (vs OPNsense's <opnsense>).

Key Structural Differences from OPNsense

Area pfSense OPNsense
Root element <pfsense> <opnsense>
NAT port forwards <nat><rule> (direct child) <nat><inbound><rule> (nested)
NAT redirect IP field <target> <internalip>
NAT 1:1 / NPt <nat><onetoone>, <nat><npt> Different location
User passwords <bcrypt-hash> <password> (SHA-based)
User privileges <priv>[] per-user array Group-based model
DNS servers <dnsserver>[] (repeating elements) Single <dnsserver> string
Aliases Flat aliases/alias[] UUID-based OPNsense/Firewall/Alias
Captive portal Zone-keyed map Completely different implementation
Traffic shaping ALTQ + dummynet Different model in newer OPNsense
Auth servers system/authserver[] Different location
Notifications system/notifications (SMTP/Telegram/etc.) Different system
Filter rules Adds id, tag, tagged, os, associated-rule-id Does not have these
Config version Decimal (22.9, 24.0) Different numbering
CRL Top-level <crl>[] Integrated differently
Kea DHCP <kea> / <kea6> (newer versions) Not present

listtags (XML Array Elements)

From pfSense's xmlparse.inc, these elements are always parsed as arrays even with a single entry. In Go, these must use []Type, never Type:

alias, authserver, bridged, ca, cert, crl, dnsserver, domainoverrides,
dyndns, gateway_item, gateway_group, gif, gre, group, hosts,
ifgroupentry, igmpentry, item, lagg, member, mobilekey, monitor_type,
npt, onetoone, openvpn-server, openvpn-client, openvpn-csc, phase1,
phase2, pool, ppp, pppoe, priv, qinqentry, queue, route, rule,
schedule, shellcmd, staticmap, timerange, user, vip, virtual_server,
vlan, wolentry

Complete Top-Level Section Inventory

Implemented in This Package
Section File Reuses OPNsense? Notes
<pfsense> root document.go Partial Root document with all top-level fields
system system.go Partial (Group, SSHConfig) pfSense-specific User, WebGUI, DNS arrays
interfaces document.go Yes (full) Map-based, identical structure
filter security.go Partial (Source, Destination) pfSense-specific FilterRule
nat (inbound + outbound) security.go Outbound reused Inbound forked for <target> vs <internalip>
dhcpd document.go Yes (full) Identical map-based structure
dhcpdv6 network.go No (pfSense-specific) Map-based with RAMode, RAPriority
snmpd document.go Yes (full) Identical
openvpn document.go Yes (full) Client + server arrays
syslog services.go No (pfSense-specific) Currently minimal
unbound services.go No (pfSense-specific) Core fields
cron services.go No (pfSense-specific) item[] array
widgets services.go No (pfSense-specific) Adds Period field
diag services.go No (pfSense-specific) IPv6NAT only
rrd document.go Yes (full) Enable flag
load_balancer document.go Yes (full) Deprecated in pfSense 2.8+
staticroutes document.go Yes (full) Identical
ppps document.go Yes (full) Identical base
gateways document.go Yes (full) Identical base
ca[] / cert[] document.go Yes (full) Top-level arrays
vlans document.go Yes (full) Identical
revision document.go Yes (full) Identical
ipsec vpn.go Partial (BoolFlag) phase1[], phase2[] listtags; client mobile config; logging sub-element
Not Yet Implemented
High Priority (common in production configs)
<aliases> -- Firewall Aliases

Path: aliases/alias[]

Field Type Description
name string Alias identifier (alphanumeric + underscore)
type string host, network, port, url, urltable, urltable_ports
address string Space-separated IPs/networks/ports/FQDNs
descr string Description
detail string Per-entry descriptions (pipe-pipe delimited)
url string URL source (for urltable types)
updatefreq string Update frequency in days (urltable types)
aliasurl string[] Array of alias URLs (alternative to single url)

OPNsense difference: OPNsense stores aliases at OPNsense/Firewall/Alias with a UUID-based model. pfSense uses a flat aliases/alias[] array.

<virtualip> -- Virtual IPs (CARP/Alias/ProxyARP)

Path: virtualip/vip[]

Field Type Description
mode string ipalias, carp, proxyarp, other
interface string Network interface
vhid string Virtual Host ID (1-255, CARP only)
advskew string Advertisement skew (0-254, CARP only)
advbase string Advertisement base frequency (1-254, CARP only)
password string CARP cluster password
subnet string IP address
subnet_bits string CIDR prefix
type string single or network
descr string Description
uniqid string Unique identifier
noexpand presence Disable NAT list expansion

Reusable: nearly identical to OPNsense's virtualip/vip[].

<hasync> -- High Availability Sync

Path: hasync/

Field Type Description
pfsyncenabled string State sync enable (on/false)
pfsyncinterface string pfsync interface
pfsyncpeerip string Peer IP
pfhostid string Host ID
synchronizetoip string XMLRPC target IP
username string XMLRPC username
password string XMLRPC password
adminsync string Admin sync flag
synchronizeusers string Sync users
synchronizeauthservers string Sync auth servers
synchronizecerts string Sync certificates
synchronizerules string Sync firewall rules
synchronizeschedules string Sync schedules
synchronizealiases string Sync aliases
synchronizenat string Sync NAT
synchronizeipsec string Sync IPsec
synchronizeopenvpn string Sync OpenVPN
synchronizedhcpd string Sync DHCP server
synchronizedhcrelay string Sync DHCP relay
synchronizekea6 string Sync Kea DHCPv6
synchronizedhcrelay6 string Sync DHCPv6 relay
synchronizewol string Sync WOL
synchronizestaticroutes string Sync static routes
synchronizevirtualip string Sync Virtual IPs
synchronizetrafficshaper string Sync ALTQ shaper
synchronizetrafficshaperlimiter string Sync limiters
synchronizednsforwarder string Sync DNS forwarder
synchronizecaptiveportal string Sync captive portal

All boolean fields store on or false.

<bridges> -- Bridge Interfaces

Path: bridges/bridged[]

Field Type Description
bridgeif string Bridge interface name (e.g., bridge0)
members string Comma-separated interface list
descr string Description
enablestp presence RSTP/STP support
ip6linklocal presence IPv6 auto link-local
maxaddr string Address cache size
timeout string Cache expiration (seconds)
maxage string STP config validity
fwdelay string STP forward delay
hellotime string STP hello interval
priority string Bridge STP priority
proto string rstp or stp
holdcnt string STP transmit hold count
ifpriority string Comma-separated interface:priority pairs
ifpathcost string Comma-separated interface:cost pairs
stp string Comma-separated STP-enabled interfaces
span string Comma-separated span ports
edge string Comma-separated edge ports
autoedge string Comma-separated auto-edge
ptp string Comma-separated point-to-point
autoptp string Comma-separated auto-PTP
static string Comma-separated sticky ports
private string Comma-separated private ports

Reusable: very similar to OPNsense's bridges/bridged[].

<gifs> -- GIF Tunnels

Path: gifs/gif[]

Field Type Description
if string Parent interface
gifif string GIF interface identifier
remote-addr string Peer encapsulation address
tunnel-local-addr string Local tunnel endpoint
tunnel-remote-addr string Remote tunnel endpoint
tunnel-remote-net string Subnet prefix (1-32 or 1-128)
tunnel-local-addr6 string IPv6 local tunnel
tunnel-remote-addr6 string IPv6 remote tunnel
tunnel-remote-net6 string IPv6 prefix
link1 presence ECN friendly behavior
link2 presence Outer source filtering
descr string Description

Reusable: nearly identical to OPNsense.

<gres> -- GRE Tunnels

Path: gres/gre[]

Same structure as GIF tunnels but uses greif instead of gifif, and adds link0.

Reusable: nearly identical to OPNsense.

Path: laggs/lagg[]

Field Type Description
laggif string LAGG interface name (e.g., lagg0)
members string Comma-separated physical interfaces
proto string none, lacp, failover, loadbalance, roundrobin
descr string Description
failovermaster string Primary failover interface or auto
lacptimeout string slow or fast
lagghash string Hash algorithm for load balancing

OPNsense difference: pfSense adds failovermaster and lagghash.

<crl> -- Certificate Revocation Lists

Path: crl[] (top-level array, repeating)

Field Type Description
refid string Unique identifier
caref string Parent CA reference
descr string Description
method string internal or existing
text string Base64-encoded CRL (imported)
lifetime string Validity (days)
serial string Serial number
cert[] array Revoked certs: refid, descr, reason, revoke_time
nat/onetoone[] -- 1:1 NAT (BiNAT)
Field Type Description
interface string Interface
ipprotocol string inet / inet6
external string External address
src / srcmask string Source network
srcnot string Negate source
dst / dstmask string Destination network
dstnot string Negate destination
nobinat string Disable binat
natreflection string Reflection mode
disabled string Disable flag
descr string Description
nat/npt[] -- IPv6 Network Prefix Translation
Field Type Description
interface string Interface
src / srcmask string Internal prefix
srcnot string Negate source
dst / dstmask string External prefix
dstnot string Negate destination
disabled string Disable flag
descr string Description
<ntpd> -- NTP Daemon

Path: ntpd/

Field Type Description
enable presence Enable NTP
interface string Listening interfaces
prefer string Preferred servers
noselect string Excluded servers
ispool string Pool-type servers
ispeer string Peer-type servers
ntpminpoll / ntpmaxpoll string Poll intervals
ntpmaxpeers string Max pool peers
orphan string Orphan stratum
dnsresolv string DNS protocol (auto/inet/inet6)
logpeer / logsys presence Logging
clockstats / loopstats / peerstats presence Statistics
statsgraph presence RRD graphs
serverauth presence NTPv3 auth
serverauthkey string Base64 auth key
serverauthkeyid string Key ID (1-65535)
serverauthalgo string md5/sha1/sha256
gps/port string GPS serial port
gps/speed string GPS baud rate
pps/port string PPS serial port

Note: time servers are at system/timeservers (space-separated), not under ntpd/.

<dnsmasq> -- DNS Forwarder

Path: dnsmasq/

Field Type Description
enable presence Enable forwarder
port string Listen port
interface string Listening interfaces
regdhcp presence Register DHCP leases
regdhcpstatic presence Register static DHCP
dhcpfirst presence DHCP before static
strict_order presence Strict query ordering
domain_needed presence Require domain for queries
no_private_reverse presence No reverse for private IPs
no_system_dns presence Ignore system DNS
strictbind presence Strict interface binding
custom_options string Raw dnsmasq config
hosts[] array Host overrides: host, domain, ip, descr, aliases/item[]
domainoverrides[] array Domain overrides: domain, ip, dnssrcip, descr
system/authserver[] -- Authentication Servers
Field Type Description
refid string Unique identifier
name string Server name
type string ldap or radius
host string Server address

LDAP-specific: ldap_caref, ldap_port, ldap_urltype, ldap_protver, ldap_scope, ldap_basedn, ldap_authcn, ldap_binddn, ldap_bindpw, ldap_timeout, ldap_attr_user, ldap_attr_group, ldap_attr_member, ldap_attr_groupobj, ldap_pam_groupdn, ldap_extended_enabled, ldap_extended_query, ldap_utf8, ldap_nostrip_at, ldap_allow_unauthenticated, ldap_rfc2307, ldap_rfc2307_userdn, ldap_rfc2307_basedn_groups.

RADIUS-specific: radius_protocol, radius_secret, radius_nasip_attribute, radius_auth_port, radius_acct_port, radius_timeout, disable_radius_msg_auth.

system/notifications -- Notification Channels
Sub-section Fields
smtp disable, ipaddress, port, timeout, ssl, sslvalidate, fromaddress, notifyemailaddress, username, password, authmech
telegram enable, api, chatid
pushover enable, apikey, userkey, sound, priority, retry, expire
slack enable, api, channel
system/sysctl/item[] -- Kernel Tunables
Field Type Description
tunable string Sysctl key (e.g., net.inet.ip.forwarding)
value string Sysctl value
descr string Description
Medium Priority
<captiveportal> -- Captive Portal

Zone-keyed map (NOT an array). Each child element is a zone name:

Field Type Description
enable presence Enable zone
zoneid string Numeric zone identifier
descr string Description
interface string Interface(s)
timeout string Hard timeout (minutes)
idletimeout string Idle timeout (minutes)
trafficquota string Megabytes
auth_method string none, authserver, radmac
auth_server / auth_server2 string Comma-separated servers
httpslogin presence HTTPS login
certref string Certificate reference
preauthurl string Pre-auth URL
redirurl string Redirect URL
bwdefaultdn / bwdefaultup string Default bandwidth (Kbit/s)
noconcurrentlogins presence No concurrent logins
termsconditions string Base64-encoded terms
page/htmltext string Base64-encoded portal page
page/errtext string Base64-encoded error page
page/logouttext string Base64-encoded logout page
element[] array Uploaded files
allowedip[] array Allowed IP entries
allowedhostname[] array Allowed hostname entries
passthrumac[] array Passthrough MAC entries
<shaper> -- ALTQ Traffic Shaping

Path: shaper/queue[] (recursive hierarchy)

Root queue:

Field Type Description
interface string Interface
name string Queue name
scheduler string HFSC, CBQ, FAIRQ, CODELQ, PRIQ
bandwidth string Numeric capacity
bandwidthtype string b, Kb, Mb, Gb, %
qlimit string Max queue depth (packets)
tbrconfig string Token bucket regulator (bytes)
enabled string on or empty

Child queue (adds to root):

Field Type Description
priority string 0-15 (PRIQ) or 0-7 (CBQ/FAIRQ)
description string Admin text
default presence Default queue flag
red / rio / ecn / codel presence AQM toggles
borrow presence CBQ bandwidth borrowing
linkshare1,2,3 string HFSC link share curve (m1, d, m2)
realtime1,2,3 string HFSC real-time curve
upperlimit1,2,3 string HFSC upper limit curve
queue[] nested Child queues (recursive)
<dnshaper> -- Dummynet Limiters

Path: dnshaper/queue[]

Field Type Description
name string Pipe identifier
number string Dummynet pipe number
bandwidth string Capacity
bandwidthtype string Scale
qlimit string Queue size (packets)
plr string Packet loss rate (0-1)
delay string Latency (ms)
buckets string Hash table entries
sched string wf2q+, fifo, qfq, rr, prio
aqm string droptail, codel, pie, red, gred
enabled string Activation
mask/type string srcaddress, dstaddress, none
mask/bits / mask/bitsv6 string CIDR prefix
queue[] nested Child queues
<schedules> -- Firewall Schedules

Path: schedules/schedule[]

Field Type Description
name string Schedule identifier
descr string Description
schedlabel string Label
timerange[] array position, month, day, hour, rangedescr
<dyndnses> -- Dynamic DNS

Path: dyndnses/dyndns[]

Field Type Description
enable presence Enable entry
type string Provider identifier
interface string Source interface
host string Hostname to update
domainname string Domain name
username string Provider username
password string Provider password (base64)
wildcard string Wildcard DNS
proxied string CDN proxied (Cloudflare)
zoneid string Zone ID (Cloudflare)
ttl string TTL value
updateurl string Custom update URL
resultmatch string Custom result regex
check_ip_mode string IP detection method
descr string Description
<dhcrelay> / <dhcrelay6> -- DHCP Relay
Field Type Description
enable presence Enable relay
interface string Comma-separated downstream interfaces
server string Comma-separated upstream server IPs
agentoption presence Append circuit/agent ID
carpstatusvip string CARP VIP for status

Note: DHCP relay and DHCP server are mutually exclusive.

<ifgroups> -- Interface Groups

Path: ifgroups/ifgroupentry[]

Field Type Description
ifname string Group name
members string Comma-separated interfaces
descr string Description

Reusable: identical to OPNsense.

<qinqs> -- QinQ (802.1ad)

Path: qinqs/qinqentry[]

Field Type Description
if string Parent interface
tag string Outer VLAN tag
tag_type string ctag or stag
members string Space-separated inner VLAN tags
descr string Description
vlanif string QinQ interface name
<wol> -- Wake on LAN

Path: wol/wolentry[]

Field Type Description
interface string Network interface
mac string MAC address
descr string Description
<installedpackages> -- Package Configuration

Dynamic structure per installed package. Common packages: miniupnpd, haproxy, pfblockerng, suricata, snort, acme.

Sub-arrays: package[] (name, internal_name, configurationfile, include_file), menu[], service[].

<igmpproxy> -- IGMP Proxy

Path: igmpproxy/igmpentry[]

Field Type Description
ifname string Interface
threshold string TTL threshold
type string upstream or downstream
address string Space-separated CIDRs
descr string Description
Low Priority (legacy/niche)
<l2tp> -- L2TP VPN Server
Field Type Description
mode string off / server
interface string Interface
localip / remoteip string IP pool
n_l2tp_units string Max clients
secret string L2TP secret
dns1 / dns2 string DNS servers
user[] array name, password, ip
radius/server / radius/secret string RADIUS auth
<pppoes> -- PPPoE Server

Path: pppoes/pppoe[]

Fields: pppoeid, mode, interface, paporchap, localip, remoteip, n_pppoe_units, n_pppoe_maxlogin, dns1, dns2, username, radius/*.

<voucher> -- Captive Portal Vouchers

Zone-keyed map: enable, freelogins_count, freelogins_resettimeout, freelogins_updatetimeouts.

<kea> / <kea6> -- Kea DHCP Backend (pfSense 2.7+)
Field Type Description
enable string Enable Kea
loglevel string Log verbosity
custom_kea_config string Custom configuration
ha/role string HA role
ha/localname / ha/localip / ha/localport string Local HA node
ha/remotename / ha/remoteip / ha/remoteport string Remote HA node
ha/tls / ha/scertref / ha/ccertref string TLS settings
Other Legacy Sections
Section Notes
<pptpd> PPTP daemon (deprecated, insecure)
<proxyarp> Proxy ARP (legacy)
<wireless> Wireless interface clones
<rrddata> Embedded RRD backup data
<shellcmd> / <earlyshellcmd> Boot-time commands (shellcmd package)

Expanded System Fields (Not Yet in Schema)

The <system> section has many fields beyond what is currently implemented. Notable missing fields:

Firewall Tuning
Field Description
maximumstates Max firewall states
maximumtableentries Max pf table entries
maximumfrags Max fragment entries
disablefilter Disable firewall entirely
scrubnodf Clear DF bit
scrubrnid Randomize IP ID
disablescrub Disable scrub
bypassstaticroutes Bypass rules for static routes
disablevpnrules Disable auto VPN rules
NAT Reflection
Field Description
disablenatreflection Disable NAT reflection
enablenatreflectionpurenat Pure NAT reflection mode
enablebinatreflection 1:1 NAT reflection
enablenatreflectionhelper FTP helper for reflection
reflectiontimeout Reflection timeout
IPv6
Field Description
ipv6allow Allow IPv6
ipv6nat_enable IPv6 NAT66
ipv6nat_ipaddr NAT66 address
prefer_ipv4 Prefer IPv4
ipv6dontcreatelocaldns Skip IPv6 DNS entries
ipv6duidtype DUID type
global-v6duid Global DHCPv6 DUID
Network Offloading
Field Description
disablechecksumoffloading Disable checksum offload
disablesegmentationoffloading Disable TSO
disablelargereceiveoffloading Disable LRO
Miscellaneous
Field Description
ip_change_kill_states Kill states on IP change
gw_down_kill_states Kill states on gateway down
skip_rules_gw_down Skip rules when GW down
keep_failover_states Keep states on failover
lb_use_sticky Sticky load balancer
schedule_states Schedule-based state clearing
pti_disabled Meltdown mitigation toggle
mds_disable MDS mitigation toggle
thermal_hardware Thermal sensor driver
harddiskstandby Disk standby timer
php_memory_limit PHP memory limit
use_mfs_tmpvar RAM-based /tmp and /var
rrdbackup / dhcpbackup / logsbackup Backup intervals
do_not_send_uniqueid Privacy flag
WebGUI Extended Fields
Field Description
port Custom HTTPS port
disablehttpredirect Disable HTTP-to-HTTPS redirect
disablehsts Disable HSTS header
ocsp-staple OCSP stapling
max_procs Max web server processes
session_timeout Session timeout (minutes)
authmode Authentication mode
nodnsrebindcheck Disable DNS rebind check
nohttpreferercheck Disable HTTP referer check
noantilockout Disable anti-lockout rule
roaming Allow roaming (multi-IP sessions)
pwhash Password hash algorithm (bcrypt/sha512)
pagenamefirst Page name first in title
User Extended Fields
Field Description
sha512-hash Legacy SHA-512 password hash
customsettings Custom GUI preferences flag
widgets Personal widget layout
dashboardcolumns Personal dashboard columns
webguicss Personal CSS theme
webguihostnamemenu Hostname display preference
interfacessort Interface sort preference
keephistory Shell history retention
cert[] User certificate references
SSHGuard (system/sshguard)
Field Description
threshold Attack score threshold
blocktime Block duration (seconds)
detection_time Detection window (seconds)
whitelist Space-separated whitelisted IPs
Auto Config Backup (system/acb)
Field Description
enable Enable ACB
device_key Device identifier
encryption_password Backup encryption password
frequency Backup frequency

Expanded Syslog Fields (Not Yet in Schema)

The current schema only captures filterdescriptions. Full pfSense syslog:

Field Description
enable Enable remote logging
remoteserver / remoteserver2 / remoteserver3 Up to 3 remote servers
sourceip Source IP for syslog packets
ipproto ipv4 / ipv6
format rfc3164 / rfc5424
logfilesize Max log file size
rotatecount Number of rotated logs
reverse Reverse display order
logcompressiontype Compression for rotated logs
disablelocallogging Disable local log storage
logall Log all facilities
default_log_level Default syslog level
filterdescriptions Filter log descriptions (1/2)
logconfigchanges Log config changes
Per-facility: auth, routing, ntpd, ppp, vpn, dpinger, resolver, dhcp, hostapd, filter, portalauth, system Remote log flags

Expanded Unbound Fields (Not Yet in Schema)

Field Description
forwarding Enable forwarding mode
forward_tls_upstream TLS to upstream forwarders
enablessl Enable DNS-over-TLS service
tlsport TLS port (default 853)
regdhcp Register DHCP leases
regdhcpstatic Register static DHCP
regovpnclients Register OpenVPN clients
aggressivensec Aggressive NSEC
use_caps 0x20 encoding
prefetch / prefetchkey Cache prefetching
dnsrecordcache Record cache size
qname-minimisation QNAME minimisation
qname-minimisation-strict Strict QNAME minimisation
always_add_short_names Short hostname entries
disable_auto_added_host_entries Skip auto host entries
disable_auto_added_access_control Skip auto ACLs
python Python module support
python_order / python_script Module config
dns64 / dns64/prefix DNS64 support
stats / stats_interval Statistics
msgcachesize Message cache (MB)
cache_max_ttl / cache_min_ttl TTL bounds
log_verbosity Log level
custom_options Base64-encoded custom config
hosts[] Host overrides: host, domain, ip, descr, aliases/item[]
domainoverrides[] Domain overrides: domain, ip, descr, tls_hostname, forward_tls_upstream
acls[] Access control lists: aclid, aclname, aclaction, row[]

Sources

Documentation

Overview

Package pfsense defines the data structures for pfSense configurations.

Package pfsense defines the data structures for pfSense configurations.

Package pfsense defines the data structures for pfSense configurations.

Package pfsense defines the data structures for pfSense configurations.

Package pfsense defines the data structures for pfSense configurations.

Package pfsense defines the data structures for pfSense configurations.

Package pfsense defines the data structures for pfSense configurations.

Package pfsense defines the data structures for pfSense configurations.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Cron 

type Cron struct {
	Items []CronItem `xml:"item,omitempty" json:"items,omitempty" yaml:"items,omitempty"`
}

Cron represents the pfSense cron configuration.

type CronItem 

type CronItem struct {
	Minute  string `xml:"minute"  json:"minute"  yaml:"minute"`
	Hour    string `xml:"hour"    json:"hour"    yaml:"hour"`
	MDay    string `xml:"mday"    json:"mday"    yaml:"mday"`
	Month   string `xml:"month"   json:"month"   yaml:"month"`
	WDay    string `xml:"wday"    json:"wday"    yaml:"wday"`
	Who     string `xml:"who"     json:"who"     yaml:"who"`
	Command string `xml:"command" json:"command" yaml:"command"`
}

CronItem represents a single pfSense cron job entry.

type DHCPv6 

type DHCPv6 struct {
	Items map[string]DHCPv6Interface `xml:",any" json:"dhcpv6,omitempty" yaml:"dhcpv6,omitempty"`
}

DHCPv6 contains the DHCPv6 server configuration for all interfaces. Uses a map-based representation identical to Dhcpd, supporting wan, lan, opt0, etc.

func (*DHCPv6) Get 

func (d *DHCPv6) Get(key string) (DHCPv6Interface, bool)

Get returns a DHCPv6 interface configuration by its key name (e.g., "lan", "opt0"). Returns the DHCPv6 interface configuration and a boolean indicating if it was found.

func (*DHCPv6) MarshalXML 

func (d *DHCPv6) MarshalXML(e *xml.Encoder, start xml.StartElement) error

MarshalXML implements custom XML marshaling for the DHCPv6 map.

func (*DHCPv6) Names 

func (d *DHCPv6) Names() []string

Names returns a slice of all DHCPv6 interface key names in the configuration.

func (*DHCPv6) UnmarshalXML 

func (d *DHCPv6) UnmarshalXML(decoder *xml.Decoder, start xml.StartElement) error

UnmarshalXML implements custom XML unmarshaling for the DHCPv6 map.

type DHCPv6Interface 

type DHCPv6Interface struct {
	Enable     string         `xml:"enable,omitempty"     json:"enable,omitempty"     yaml:"enable,omitempty"`
	Range      opnsense.Range `xml:"range,omitempty"      json:"range"                yaml:"range,omitempty"`
	RAMode     string         `xml:"ramode,omitempty"     json:"raMode,omitempty"     yaml:"raMode,omitempty"`
	RAPriority string         `xml:"rapriority,omitempty" json:"raPriority,omitempty" yaml:"raPriority,omitempty"`
}

DHCPv6Interface contains the DHCPv6 server configuration for a specific interface. It includes pfSense-specific fields for Router Advertisement mode and priority.

type Dhcpd 

type Dhcpd struct {
	Items map[string]DhcpdInterface `xml:",any" json:"dhcp,omitempty" yaml:"dhcp,omitempty"`
}

Dhcpd contains the DHCP server configuration for all pfSense interfaces. Uses a map-based representation where keys are interface identifiers (wan, lan, opt0, etc.).

func (*Dhcpd) Get 

func (d *Dhcpd) Get(key string) (DhcpdInterface, bool)

Get returns a DHCP interface configuration by its key name (e.g., "wan", "lan", "opt0"). Returns the DHCP interface configuration and a boolean indicating if it was found.

func (*Dhcpd) Lan 

func (d *Dhcpd) Lan() (DhcpdInterface, bool)

Lan returns the LAN DHCP configuration if it exists, otherwise returns a zero-value DhcpdInterface and false.

func (*Dhcpd) MarshalXML 

func (d *Dhcpd) MarshalXML(e *xml.Encoder, start xml.StartElement) error

MarshalXML implements custom XML marshaling for the Dhcpd map.

func (*Dhcpd) Names 

func (d *Dhcpd) Names() []string

Names returns a sorted list of all DHCP interface names.

func (*Dhcpd) UnmarshalXML 

func (d *Dhcpd) UnmarshalXML(decoder *xml.Decoder, start xml.StartElement) error

UnmarshalXML implements custom XML unmarshaling for the Dhcpd map.

func (*Dhcpd) Wan 

func (d *Dhcpd) Wan() (DhcpdInterface, bool)

Wan returns the WAN DHCP configuration if it exists, otherwise returns a zero-value DhcpdInterface and false.

type DhcpdInterface 

type DhcpdInterface struct {
	Enable              opnsense.BoolFlag           `xml:"enable,omitempty"              json:"enable,omitempty"              yaml:"enable,omitempty"`
	Range               opnsense.Range              `xml:"range,omitempty"               json:"range"                         yaml:"range,omitempty"`
	Gateway             string                      `xml:"gateway,omitempty"             json:"gateway,omitempty"             yaml:"gateway,omitempty"`
	DdnsDomainAlgorithm string                      `xml:"ddnsdomainalgorithm,omitempty" json:"ddnsdomainalgorithm,omitempty" yaml:"ddnsdomainalgorithm,omitempty"`
	NumberOptions       []opnsense.DHCPNumberOption `xml:"numberoptions>item,omitempty"  json:"numberOptions,omitempty"       yaml:"numberOptions,omitempty"`
	Winsserver          string                      `xml:"winsserver,omitempty"          json:"winsserver,omitempty"          yaml:"winsserver,omitempty"`
	Dnsserver           string                      `xml:"dnsserver,omitempty"           json:"dnsserver,omitempty"           yaml:"dnsserver,omitempty"`
	Ntpserver           string                      `xml:"ntpserver,omitempty"           json:"ntpserver,omitempty"           yaml:"ntpserver,omitempty"`
	Staticmap           []opnsense.DHCPStaticLease  `xml:"staticmap,omitempty"           json:"staticmap,omitempty"           yaml:"staticmap,omitempty"`

	// Advanced DHCP fields
	AliasAddress   string `xml:"alias-address,omitempty"  json:"aliasAddress,omitempty"   yaml:"aliasAddress,omitempty"`
	AliasSubnet    string `xml:"alias-subnet,omitempty"   json:"aliasSubnet,omitempty"    yaml:"aliasSubnet,omitempty"`
	DHCPRejectFrom string `xml:"dhcprejectfrom,omitempty" json:"dhcprejectfrom,omitempty" yaml:"dhcprejectfrom,omitempty"`

	// Advanced DHCP options
	AdvDHCPPTTimeout              string `` /* 131-byte string literal not displayed */
	AdvDHCPPTRetry                string `` /* 129-byte string literal not displayed */
	AdvDHCPPTSelectTimeout        string `` /* 137-byte string literal not displayed */
	AdvDHCPPTReboot               string `` /* 130-byte string literal not displayed */
	AdvDHCPPTBackoffCutoff        string `` /* 137-byte string literal not displayed */
	AdvDHCPPTInitialInterval      string `` /* 139-byte string literal not displayed */
	AdvDHCPPTValues               string `` /* 130-byte string literal not displayed */
	AdvDHCPSendOptions            string `` /* 133-byte string literal not displayed */
	AdvDHCPRequestOptions         string `` /* 136-byte string literal not displayed */
	AdvDHCPRequiredOptions        string `` /* 137-byte string literal not displayed */
	AdvDHCPOptionModifiers        string `` /* 137-byte string literal not displayed */
	AdvDHCPConfigAdvanced         string `` /* 136-byte string literal not displayed */
	AdvDHCPConfigFileOverride     string `` /* 140-byte string literal not displayed */
	AdvDHCPConfigFileOverridePath string `` /* 144-byte string literal not displayed */

	// Advanced DHCPv6 fields
	Track6Interface                                 string `` /* 167-byte string literal not displayed */
	Track6PrefixID                                  string `` /* 166-byte string literal not displayed */
	AdvDHCP6InterfaceStatementSendOptions           string `` /* 189-byte string literal not displayed */
	AdvDHCP6InterfaceStatementRequestOptions        string `` /* 192-byte string literal not displayed */
	AdvDHCP6InterfaceStatementInformationOnlyEnable string `` /* 199-byte string literal not displayed */
	AdvDHCP6InterfaceStatementScript                string `` /* 184-byte string literal not displayed */
	AdvDHCP6IDAssocStatementAddressEnable           string `` /* 189-byte string literal not displayed */
	AdvDHCP6IDAssocStatementAddress                 string `` /* 183-byte string literal not displayed */
	AdvDHCP6IDAssocStatementAddressID               string `` /* 185-byte string literal not displayed */
	AdvDHCP6IDAssocStatementAddressPLTime           string `` /* 189-byte string literal not displayed */
	AdvDHCP6IDAssocStatementAddressVLTime           string `` /* 189-byte string literal not displayed */
	AdvDHCP6IDAssocStatementPrefixEnable            string `` /* 188-byte string literal not displayed */
	AdvDHCP6IDAssocStatementPrefix                  string `` /* 182-byte string literal not displayed */
	AdvDHCP6IDAssocStatementPrefixID                string `` /* 184-byte string literal not displayed */
	AdvDHCP6IDAssocStatementPrefixPLTime            string `` /* 188-byte string literal not displayed */
	AdvDHCP6IDAssocStatementPrefixVLTime            string `` /* 188-byte string literal not displayed */
	AdvDHCP6PrefixInterfaceStatementSLALen          string `` /* 190-byte string literal not displayed */
	AdvDHCP6AuthenticationStatementAuthName         string `` /* 191-byte string literal not displayed */
	AdvDHCP6AuthenticationStatementProtocol         string `` /* 191-byte string literal not displayed */
	AdvDHCP6AuthenticationStatementAlgorithm        string `` /* 192-byte string literal not displayed */
	AdvDHCP6AuthenticationStatementRDM              string `` /* 186-byte string literal not displayed */
	AdvDHCP6KeyInfoStatementKeyName                 string `` /* 183-byte string literal not displayed */
	AdvDHCP6KeyInfoStatementRealm                   string `` /* 181-byte string literal not displayed */
	AdvDHCP6KeyInfoStatementKeyID                   string `` /* 181-byte string literal not displayed */
	AdvDHCP6KeyInfoStatementSecret                  string `` /* 182-byte string literal not displayed */
	AdvDHCP6KeyInfoStatementExpire                  string `` /* 182-byte string literal not displayed */
	AdvDHCP6ConfigAdvanced                          string `` /* 174-byte string literal not displayed */
	AdvDHCP6ConfigFileOverride                      string `` /* 178-byte string literal not displayed */
	AdvDHCP6ConfigFileOverridePath                  string `` /* 182-byte string literal not displayed */
}

DhcpdInterface contains the DHCP server configuration for a specific pfSense interface. It is a copy-on-write fork of opnsense.DhcpdInterface with Enable changed from string to BoolFlag, because pfSense uses presence-based <enable/> elements.

func (DhcpdInterface) MarshalXML 

func (d DhcpdInterface) MarshalXML(e *xml.Encoder, start xml.StartElement) error

MarshalXML implements custom XML marshaling for DhcpdInterface, ensuring that the Enable BoolFlag field is addressable so (*BoolFlag).MarshalXML is invoked. Without this, direct xml.Marshal calls on DhcpdInterface values would fall back to default bool serialization instead of producing pfSense-compatible <enable/> elements. Uses a value receiver so both value and pointer marshaling work correctly.

type Diag 

type Diag struct {
	IPv6NAT IPv6NAT `xml:"ipv6nat,omitempty" json:"ipv6nat" yaml:"ipv6nat,omitempty"`
}

Diag represents the pfSense diagnostics configuration.

type Document 

type Document struct {
	XMLName      xml.Name                        `xml:"pfsense"                 json:"-"                    yaml:"-"`
	Version      string                          `xml:"version,omitempty"       json:"version,omitempty"    yaml:"version,omitempty"`
	LastChange   string                          `xml:"lastchange,omitempty"    json:"lastChange,omitempty" yaml:"lastChange,omitempty"`
	System       System                          `xml:"system,omitempty"        json:"system"               yaml:"system,omitempty"`
	Interfaces   Interfaces                      `xml:"interfaces,omitempty"    json:"interfaces"           yaml:"interfaces,omitempty"`
	Dhcpd        Dhcpd                           `xml:"dhcpd,omitempty"         json:"dhcpd"                yaml:"dhcpd,omitempty"`
	DHCPv6Server DHCPv6                          `xml:"dhcpdv6,omitempty"       json:"dhcpdv6"              yaml:"dhcpdv6,omitempty"`
	Snmpd        opnsense.Snmpd                  `xml:"snmpd,omitempty"         json:"snmpd"                yaml:"snmpd,omitempty"`
	Diag         Diag                            `xml:"diag,omitempty"          json:"diag"                 yaml:"diag,omitempty"`
	Syslog       SyslogConfig                    `xml:"syslog,omitempty"        json:"syslog"               yaml:"syslog,omitempty"`
	Nat          Nat                             `xml:"nat,omitempty"           json:"nat"                  yaml:"nat,omitempty"`
	Filter       Filter                          `xml:"filter,omitempty"        json:"filter"               yaml:"filter,omitempty"`
	Cron         Cron                            `xml:"cron,omitempty"          json:"cron"                 yaml:"cron,omitempty"`
	Rrd          opnsense.Rrd                    `xml:"rrd,omitempty"           json:"rrd"                  yaml:"rrd,omitempty"`
	LoadBalancer opnsense.LoadBalancer           `xml:"load_balancer,omitempty" json:"loadBalancer"         yaml:"loadBalancer,omitempty"`
	Widgets      Widgets                         `xml:"widgets,omitempty"       json:"widgets"              yaml:"widgets,omitempty"`
	OpenVPN      opnsense.OpenVPN                `xml:"openvpn,omitempty"       json:"openvpn"              yaml:"openvpn,omitempty"`
	IPsec        IPsec                           `xml:"ipsec,omitempty"         json:"ipsec"                yaml:"ipsec,omitempty"`
	Unbound      UnboundConfig                   `xml:"unbound,omitempty"       json:"unbound"              yaml:"unbound,omitempty"`
	Revision     opnsense.Revision               `xml:"revision,omitempty"      json:"revision"             yaml:"revision,omitempty"`
	StaticRoutes opnsense.StaticRoutes           `xml:"staticroutes,omitempty"  json:"staticroutes"         yaml:"staticroutes,omitempty"`
	PPPs         opnsense.PPPInterfaces          `xml:"ppps,omitempty"          json:"ppps"                 yaml:"ppps,omitempty"`
	Gateways     opnsense.Gateways               `xml:"gateways,omitempty"      json:"gateways"             yaml:"gateways,omitempty"`
	CAs          []opnsense.CertificateAuthority `xml:"ca,omitempty"            json:"ca,omitempty"         yaml:"ca,omitempty"`
	Certs        []opnsense.Cert                 `xml:"cert,omitempty"          json:"cert,omitempty"       yaml:"cert,omitempty"`
	VLANs        opnsense.VLANs                  `xml:"vlans,omitempty"         json:"vlans"                yaml:"vlans,omitempty"`
}

Document is the root of the pfSense configuration.

func NewDocument 

func NewDocument() *Document

NewDocument returns a new Document with all slice and map fields initialized for safe use.

func (*Document) FilterRules 

func (p *Document) FilterRules() []FilterRule

FilterRules returns a slice of all firewall filter rules configured in the system.

func (*Document) Hostname 

func (p *Document) Hostname() string

Hostname returns the configured hostname from the system configuration.

func (*Document) InterfaceByName 

func (p *Document) InterfaceByName(name string) (Interface, bool)

InterfaceByName returns a network interface by its interface name (e.g., "em0", "igb0"). Returns a copy of the interface and true if found, or zero-value and false if not.

type Filter 

type Filter struct {
	Separator string       `xml:"separator,omitempty" json:"separator,omitempty" yaml:"separator,omitempty"`
	Rule      []FilterRule `xml:"rule"                json:"rules,omitempty"     yaml:"rules,omitempty"`
}

Filter represents the pfSense firewall filter configuration.

type FilterRule 

type FilterRule struct {
	XMLName     xml.Name               `xml:"rule"`
	Type        string                 `xml:"type"                 json:"type"                  yaml:"type"`
	Descr       string                 `xml:"descr,omitempty"      json:"description,omitempty" yaml:"description,omitempty"`
	Interface   opnsense.InterfaceList `xml:"interface,omitempty"  json:"interface,omitempty"   yaml:"interface,omitempty"`
	IPProtocol  string                 `xml:"ipprotocol,omitempty" json:"ipProtocol,omitempty"  yaml:"ipProtocol,omitempty"`
	StateType   string                 `xml:"statetype,omitempty"  json:"stateType,omitempty"   yaml:"stateType,omitempty"`
	Direction   string                 `xml:"direction,omitempty"  json:"direction,omitempty"   yaml:"direction,omitempty"`
	Floating    string                 `xml:"floating,omitempty"   json:"floating,omitempty"    yaml:"floating,omitempty"`
	Quick       opnsense.BoolFlag      `xml:"quick,omitempty"      json:"quick"                 yaml:"quick,omitempty"`
	Protocol    string                 `xml:"protocol,omitempty"   json:"protocol,omitempty"    yaml:"protocol,omitempty"`
	Source      opnsense.Source        `xml:"source"               json:"source"                yaml:"source"`
	Destination opnsense.Destination   `xml:"destination"          json:"destination"           yaml:"destination"`
	Target      string                 `xml:"target,omitempty"     json:"target,omitempty"      yaml:"target,omitempty"`
	Gateway     string                 `xml:"gateway,omitempty"    json:"gateway,omitempty"     yaml:"gateway,omitempty"`
	SourcePort  string                 `xml:"sourceport,omitempty" json:"sourcePort,omitempty"  yaml:"sourcePort,omitempty"`
	Log         opnsense.BoolFlag      `xml:"log,omitempty"        json:"log"                   yaml:"log,omitempty"`
	Disabled    opnsense.BoolFlag      `xml:"disabled,omitempty"   json:"disabled"              yaml:"disabled,omitempty"`
	Tracker     string                 `xml:"tracker,omitempty"    json:"tracker,omitempty"     yaml:"tracker,omitempty"`
	// Rate-limiting fields (DoS protection)
	MaxSrcNodes     string `xml:"max-src-nodes,omitempty"      json:"maxSrcNodes,omitempty"     yaml:"maxSrcNodes,omitempty"`
	MaxSrcConn      string `xml:"max-src-conn,omitempty"       json:"maxSrcConn,omitempty"      yaml:"maxSrcConn,omitempty"`
	MaxSrcConnRate  string `xml:"max-src-conn-rate,omitempty"  json:"maxSrcConnRate,omitempty"  yaml:"maxSrcConnRate,omitempty"`
	MaxSrcConnRates string `xml:"max-src-conn-rates,omitempty" json:"maxSrcConnRates,omitempty" yaml:"maxSrcConnRates,omitempty"`
	// TCP/ICMP fields
	TCPFlags1   string            `xml:"tcpflags1,omitempty"    json:"tcpFlags1,omitempty" yaml:"tcpFlags1,omitempty"`
	TCPFlags2   string            `xml:"tcpflags2,omitempty"    json:"tcpFlags2,omitempty" yaml:"tcpFlags2,omitempty"`
	TCPFlagsAny opnsense.BoolFlag `xml:"tcpflags_any,omitempty" json:"tcpFlagsAny"         yaml:"tcpFlagsAny,omitempty"`
	ICMPType    string            `xml:"icmptype,omitempty"     json:"icmpType,omitempty"  yaml:"icmpType,omitempty"`
	ICMP6Type   string            `xml:"icmp6-type,omitempty"   json:"icmp6Type,omitempty" yaml:"icmp6Type,omitempty"`
	// State and advanced fields
	StateTimeout   string            `xml:"statetimeout,omitempty"   json:"stateTimeout,omitempty" yaml:"stateTimeout,omitempty"`
	AllowOpts      opnsense.BoolFlag `xml:"allowopts,omitempty"      json:"allowOpts"              yaml:"allowOpts,omitempty"`
	DisableReplyTo opnsense.BoolFlag `xml:"disablereplyto,omitempty" json:"disableReplyTo"         yaml:"disableReplyTo,omitempty"`
	NoPfSync       opnsense.BoolFlag `xml:"nopfsync,omitempty"       json:"noPfSync"               yaml:"noPfSync,omitempty"`
	NoSync         opnsense.BoolFlag `xml:"nosync,omitempty"         json:"noSync"                 yaml:"noSync,omitempty"`
	Updated        *opnsense.Updated `xml:"updated,omitempty"        json:"updated,omitempty"      yaml:"updated,omitempty"`
	Created        *opnsense.Created `xml:"created,omitempty"        json:"created,omitempty"      yaml:"created,omitempty"`
	UUID           string            `xml:"uuid,attr,omitempty"      json:"uuid,omitempty"         yaml:"uuid,omitempty"`
	// pfSense-specific fields
	ID               string `xml:"id,omitempty"                 json:"id,omitempty"               yaml:"id,omitempty"`
	Tag              string `xml:"tag,omitempty"                json:"tag,omitempty"              yaml:"tag,omitempty"`
	Tagged           string `xml:"tagged,omitempty"             json:"tagged,omitempty"           yaml:"tagged,omitempty"`
	Max              string `xml:"max,omitempty"                json:"max,omitempty"              yaml:"max,omitempty"`
	MaxSrcStates     string `xml:"max-src-states,omitempty"     json:"maxSrcStates,omitempty"     yaml:"maxSrcStates,omitempty"`
	OS               string `xml:"os,omitempty"                 json:"os,omitempty"               yaml:"os,omitempty"`
	AssociatedRuleID string `xml:"associated-rule-id,omitempty" json:"associatedRuleID,omitempty" yaml:"associatedRuleID,omitempty"`
}

FilterRule represents a pfSense firewall rule. It extends the base OPNsense Rule fields with pfSense-specific attributes such as rule ID, pf tags, state limits, OS fingerprinting, and NAT association.

type Group 

type Group struct {
	Name        string `xml:"name"        json:"name"                  yaml:"name"`
	Description string `xml:"description" json:"description,omitempty" yaml:"description,omitempty"`
	Scope       string `xml:"scope"       json:"scope"                 yaml:"scope"`
	//nolint:staticcheck // Field name matches pfSense schema
	Gid    string   `xml:"gid"    json:"gid"                  yaml:"gid"`
	Member []string `xml:"member" json:"members,omitempty"    yaml:"members,omitempty"`
	Priv   []string `xml:"priv"   json:"privileges,omitempty" yaml:"privileges,omitempty"`
}

Group represents a pfSense group. Forked from opnsense.Group because pfSense supports multiple <priv> elements per group (copy-on-write per AGENTS.md §6.1).

type IPsec added in v1.4.0 

type IPsec struct {
	Phase1     []IPsecPhase1 `xml:"phase1,omitempty"    json:"phase1,omitempty"     yaml:"phase1,omitempty"`
	Phase2     []IPsecPhase2 `xml:"phase2,omitempty"    json:"phase2,omitempty"     yaml:"phase2,omitempty"`
	MobileKeys []MobileKey   `xml:"mobilekey,omitempty" json:"mobileKeys,omitempty" yaml:"mobileKeys,omitempty"`
	Client     IPsecClient   `xml:"client,omitempty"    json:"client"               yaml:"client,omitempty"`
	Logging    IPsecLogging  `xml:"logging,omitempty"   json:"logging"              yaml:"logging,omitempty"`
}

IPsec represents the top-level IPsec VPN configuration container.

func NewIPsec added in v1.4.0 

func NewIPsec() IPsec

NewIPsec returns a new IPsec configuration with Phase1, Phase2, and MobileKeys slices initialized for safe use.

type IPsecClient added in v1.4.0 

type IPsecClient struct {
	Enable      opnsense.BoolFlag `xml:"enable,omitempty"          json:"enable"                  yaml:"enable,omitempty"`
	UserSource  string            `xml:"user_source,omitempty"     json:"userSource,omitempty"    yaml:"userSource,omitempty"`
	GroupSource string            `xml:"group_source,omitempty"    json:"groupSource,omitempty"   yaml:"groupSource,omitempty"`
	PoolAddress string            `xml:"pool_address,omitempty"    json:"poolAddress,omitempty"   yaml:"poolAddress,omitempty"`
	PoolNetbits string            `xml:"pool_netbits,omitempty"    json:"poolNetbits,omitempty"   yaml:"poolNetbits,omitempty"`
	PoolAddrV6  string            `xml:"pool_address_v6,omitempty" json:"poolAddressV6,omitempty" yaml:"poolAddressV6,omitempty"`
	PoolNetV6   string            `xml:"pool_netbits_v6,omitempty" json:"poolNetbitsV6,omitempty" yaml:"poolNetbitsV6,omitempty"`
	DNSServer1  string            `xml:"dns_server1,omitempty"     json:"dnsServer1,omitempty"    yaml:"dnsServer1,omitempty"`
	DNSServer2  string            `xml:"dns_server2,omitempty"     json:"dnsServer2,omitempty"    yaml:"dnsServer2,omitempty"`
	DNSServer3  string            `xml:"dns_server3,omitempty"     json:"dnsServer3,omitempty"    yaml:"dnsServer3,omitempty"`
	DNSServer4  string            `xml:"dns_server4,omitempty"     json:"dnsServer4,omitempty"    yaml:"dnsServer4,omitempty"`
	WINSServer1 string            `xml:"wins_server1,omitempty"    json:"winsServer1,omitempty"   yaml:"winsServer1,omitempty"`
	WINSServer2 string            `xml:"wins_server2,omitempty"    json:"winsServer2,omitempty"   yaml:"winsServer2,omitempty"`
	DNSDomain   string            `xml:"dns_domain,omitempty"      json:"dnsDomain,omitempty"     yaml:"dnsDomain,omitempty"`
	DNSSplit    string            `xml:"dns_split,omitempty"       json:"dnsSplit,omitempty"      yaml:"dnsSplit,omitempty"`
	LoginBanner string            `xml:"login_banner,omitempty"    json:"loginBanner,omitempty"   yaml:"loginBanner,omitempty"`
	SavePasswd  opnsense.BoolFlag `xml:"save_passwd,omitempty"     json:"savePasswd"              yaml:"savePasswd,omitempty"`
}

IPsecClient represents the mobile IPsec client pool configuration (the <client> element within <ipsec>).

func (IPsecClient) MarshalXML added in v1.4.0 

func (c IPsecClient) MarshalXML(e *xml.Encoder, start xml.StartElement) error

MarshalXML implements custom XML marshaling for IPsecClient, ensuring that the Enable and SavePasswd BoolFlag fields are addressable so (*BoolFlag).MarshalXML is invoked. Without this, direct xml.Marshal calls on IPsecClient values would fall back to default bool serialization instead of producing pfSense-compatible presence elements. Uses a value receiver so both value and pointer marshaling work correctly.

type IPsecEncryptionAlgorithm added in v1.4.0 

type IPsecEncryptionAlgorithm struct {
	Name   string `xml:"name,omitempty"   json:"name,omitempty"   yaml:"name,omitempty"`
	KeyLen string `xml:"keylen,omitempty" json:"keyLen,omitempty" yaml:"keyLen,omitempty"`
}

IPsecEncryptionAlgorithm represents a single encryption algorithm option used in Phase 1 and Phase 2.

type IPsecHashAlgorithm added in v1.4.0 

type IPsecHashAlgorithm struct {
	Name string `xml:"name,omitempty" json:"name,omitempty" yaml:"name,omitempty"`
}

IPsecHashAlgorithm represents a single hash algorithm option used in Phase 2.

type IPsecID added in v1.4.0 

type IPsecID struct {
	Type    string `xml:"type,omitempty"    json:"type,omitempty"    yaml:"type,omitempty"`
	Address string `xml:"address,omitempty" json:"address,omitempty" yaml:"address,omitempty"`
	Netbits string `xml:"netbits,omitempty" json:"netbits,omitempty" yaml:"netbits,omitempty"`
}

IPsecID represents a network identity element, used for localid, remoteid, and natlocalid in IPsec configurations.

type IPsecLogging added in v1.4.0 

type IPsecLogging struct {
	// Dmn is the strongSwan daemon (main process) log level.
	Dmn string `xml:"dmn,omitempty" json:"dmn,omitempty" yaml:"dmn,omitempty"`
	// Mgr is the IKE SA manager log level.
	Mgr string `xml:"mgr,omitempty" json:"mgr,omitempty" yaml:"mgr,omitempty"`
	// Ike is the IKE protocol log level.
	Ike string `xml:"ike,omitempty" json:"ike,omitempty" yaml:"ike,omitempty"`
	// Chd is the child SA (IPsec SA) log level.
	Chd string `xml:"chd,omitempty" json:"chd,omitempty" yaml:"chd,omitempty"`
	// Job is the job processing log level.
	Job string `xml:"job,omitempty" json:"job,omitempty" yaml:"job,omitempty"`
	// Cfg is the configuration backend log level.
	Cfg string `xml:"cfg,omitempty" json:"cfg,omitempty" yaml:"cfg,omitempty"`
	// Knl is the kernel interface log level.
	Knl string `xml:"knl,omitempty" json:"knl,omitempty" yaml:"knl,omitempty"`
	// Net is the networking log level.
	Net string `xml:"net,omitempty" json:"net,omitempty" yaml:"net,omitempty"`
	// Asn is the ASN.1 encoding/decoding log level.
	Asn string `xml:"asn,omitempty" json:"asn,omitempty" yaml:"asn,omitempty"`
	// Enc is the cryptographic operations log level.
	Enc string `xml:"enc,omitempty" json:"enc,omitempty" yaml:"enc,omitempty"`
	// Lib is the strongSwan library log level.
	Lib string `xml:"lib,omitempty" json:"lib,omitempty" yaml:"lib,omitempty"`
}

IPsecLogging represents per-subsystem strongSwan log level configuration. Parsed from config.xml but intentionally not mapped to the common model — log levels are daemon tuning, not security-relevant configuration for audit/export.

type IPsecPhase1 added in v1.4.0 

type IPsecPhase1 struct {
	IKEId      string `xml:"ikeid,omitempty"                 json:"ikeId,omitempty"                yaml:"ikeId,omitempty"`
	IKEType    string `xml:"iketype,omitempty"               json:"ikeType,omitempty"              yaml:"ikeType,omitempty"`
	Interface  string `xml:"interface,omitempty"             json:"interface,omitempty"            yaml:"interface,omitempty"`
	RemoteGW   string `xml:"remote-gateway,omitempty"        json:"remoteGateway,omitempty"        yaml:"remoteGateway,omitempty"`
	Protocol   string `xml:"protocol,omitempty"              json:"protocol,omitempty"             yaml:"protocol,omitempty"`
	MyIDType   string `xml:"myid_type,omitempty"             json:"myIdType,omitempty"             yaml:"myIdType,omitempty"`
	MyIDData   string `xml:"myid_data,omitempty"             json:"myIdData,omitempty"             yaml:"myIdData,omitempty"`
	PeerIDType string `xml:"peerid_type,omitempty"           json:"peerIdType,omitempty"           yaml:"peerIdType,omitempty"`
	PeerIDData string `xml:"peerid_data,omitempty"           json:"peerIdData,omitempty"           yaml:"peerIdData,omitempty"`
	AuthMethod string `xml:"authentication_method,omitempty" json:"authenticationMethod,omitempty" yaml:"authenticationMethod,omitempty"`
	// PreSharedKey is the IPsec pre-shared key. Intentionally excluded from the common model
	// (secrets must not reach the export pipeline). The sanitizer handles this at the XML level.
	// If this field is ever mapped to common.IPsecPhase1Tunnel, redactedCopyUnsafe() in
	// internal/processor/report.go MUST be updated to redact it.
	PreSharedKey string                `xml:"pre-shared-key,omitempty" json:"-"                      yaml:"-"`
	CertRef      string                `xml:"certref,omitempty"        json:"certRef,omitempty"      yaml:"certRef,omitempty"`
	CARef        string                `xml:"caref,omitempty"          json:"caRef,omitempty"        yaml:"caRef,omitempty"`
	Lifetime     string                `xml:"lifetime,omitempty"       json:"lifetime,omitempty"     yaml:"lifetime,omitempty"`
	RekeyTime    string                `xml:"rekey_time,omitempty"     json:"rekeyTime,omitempty"    yaml:"rekeyTime,omitempty"`
	ReauthTime   string                `xml:"reauth_time,omitempty"    json:"reauthTime,omitempty"   yaml:"reauthTime,omitempty"`
	RandTime     string                `xml:"rand_time,omitempty"      json:"randTime,omitempty"     yaml:"randTime,omitempty"`
	Mode         string                `xml:"mode,omitempty"           json:"mode,omitempty"         yaml:"mode,omitempty"`
	NATTraversal string                `xml:"nat_traversal,omitempty"  json:"natTraversal,omitempty" yaml:"natTraversal,omitempty"`
	Mobike       string                `xml:"mobike,omitempty"         json:"mobike,omitempty"       yaml:"mobike,omitempty"`
	DPDDelay     string                `xml:"dpd_delay,omitempty"      json:"dpdDelay,omitempty"     yaml:"dpdDelay,omitempty"`
	DPDMaxFail   string                `xml:"dpd_maxfail,omitempty"    json:"dpdMaxFail,omitempty"   yaml:"dpdMaxFail,omitempty"`
	StartAction  string                `xml:"startaction,omitempty"    json:"startAction,omitempty"  yaml:"startAction,omitempty"`
	CloseAction  string                `xml:"closeaction,omitempty"    json:"closeAction,omitempty"  yaml:"closeAction,omitempty"`
	Disabled     opnsense.BoolFlag     `xml:"disabled,omitempty"       json:"disabled"               yaml:"disabled,omitempty"`
	Descr        string                `xml:"descr,omitempty"          json:"descr,omitempty"        yaml:"descr,omitempty"`
	Mobile       opnsense.BoolFlag     `xml:"mobile,omitempty"         json:"mobile"                 yaml:"mobile,omitempty"`
	IKEPort      string                `xml:"ikeport,omitempty"        json:"ikePort,omitempty"      yaml:"ikePort,omitempty"`
	NATTPort     string                `xml:"nattport,omitempty"       json:"nattPort,omitempty"     yaml:"nattPort,omitempty"`
	SplitConn    string                `xml:"splitconn,omitempty"      json:"splitConn,omitempty"    yaml:"splitConn,omitempty"`
	Encryption   IPsecPhase1Encryption `xml:"encryption,omitempty"     json:"encryption"             yaml:"encryption,omitempty"`
}

IPsecPhase1 represents a single IKE Phase 1 (SA) entry. Phase 1 entries are listtags in pfSense config.xml.

func (IPsecPhase1) MarshalXML added in v1.4.0 

func (p IPsecPhase1) MarshalXML(e *xml.Encoder, start xml.StartElement) error

MarshalXML implements custom XML marshaling for IPsecPhase1, ensuring that the Disabled and Mobile BoolFlag fields are addressable so (*BoolFlag).MarshalXML is invoked. Without this, direct xml.Marshal calls on IPsecPhase1 values would fall back to default bool serialization instead of producing pfSense-compatible presence elements. Uses a value receiver so both value and pointer marshaling work correctly.

type IPsecPhase1Encryption added in v1.4.0 

type IPsecPhase1Encryption struct {
	Algorithms []IPsecEncryptionAlgorithm `xml:"encryption-algorithm-option,omitempty" json:"algorithms,omitempty" yaml:"algorithms,omitempty"`
}

IPsecPhase1Encryption wraps the encryption sub-element containing algorithm options for Phase 1.

type IPsecPhase2 added in v1.4.0 

type IPsecPhase2 struct {
	IKEId                string                     `xml:"ikeid,omitempty"                       json:"ikeId,omitempty"                yaml:"ikeId,omitempty"`
	UniqID               string                     `xml:"uniqid,omitempty"                      json:"uniqId,omitempty"               yaml:"uniqId,omitempty"`
	Mode                 string                     `xml:"mode,omitempty"                        json:"mode,omitempty"                 yaml:"mode,omitempty"`
	Disabled             opnsense.BoolFlag          `xml:"disabled,omitempty"                    json:"disabled"                       yaml:"disabled,omitempty"`
	ReqID                string                     `xml:"reqid,omitempty"                       json:"reqId,omitempty"                yaml:"reqId,omitempty"`
	LocalID              IPsecID                    `xml:"localid,omitempty"                     json:"localId"                        yaml:"localId,omitempty"`
	RemoteID             IPsecID                    `xml:"remoteid,omitempty"                    json:"remoteId"                       yaml:"remoteId,omitempty"`
	NATLocalID           IPsecID                    `xml:"natlocalid,omitempty"                  json:"natLocalId"                     yaml:"natLocalId,omitempty"`
	Protocol             string                     `xml:"protocol,omitempty"                    json:"protocol,omitempty"             yaml:"protocol,omitempty"`
	EncryptionAlgorithms []IPsecEncryptionAlgorithm `xml:"encryption-algorithm-option,omitempty" json:"encryptionAlgorithms,omitempty" yaml:"encryptionAlgorithms,omitempty"`
	HashAlgorithms       []IPsecHashAlgorithm       `xml:"hash-algorithm-option,omitempty"       json:"hashAlgorithms,omitempty"       yaml:"hashAlgorithms,omitempty"`
	PFSGroup             string                     `xml:"pfsgroup,omitempty"                    json:"pfsGroup,omitempty"             yaml:"pfsGroup,omitempty"`
	Lifetime             string                     `xml:"lifetime,omitempty"                    json:"lifetime,omitempty"             yaml:"lifetime,omitempty"`
	PingHost             string                     `xml:"pinghost,omitempty"                    json:"pingHost,omitempty"             yaml:"pingHost,omitempty"`
	Descr                string                     `xml:"descr,omitempty"                       json:"descr,omitempty"                yaml:"descr,omitempty"`
}

IPsecPhase2 represents a single IPsec Phase 2 (child SA) entry. Phase 2 entries are listtags in pfSense config.xml.

func (IPsecPhase2) MarshalXML added in v1.4.0 

func (p IPsecPhase2) MarshalXML(e *xml.Encoder, start xml.StartElement) error

MarshalXML implements custom XML marshaling for IPsecPhase2, ensuring that the Disabled BoolFlag field is addressable so (*BoolFlag).MarshalXML is invoked. Without this, direct xml.Marshal calls on IPsecPhase2 values would fall back to default bool serialization instead of producing pfSense-compatible presence elements. Uses a value receiver so both value and pointer marshaling work correctly.

type IPv6NAT 

type IPv6NAT struct {
	IPAddr string `xml:"ipaddr,omitempty" json:"ipaddr,omitempty" yaml:"ipaddr,omitempty"`
}

IPv6NAT represents the pfSense IPv6 NAT diagnostics configuration.

type InboundRule 

type InboundRule struct {
	XMLName          xml.Name               `xml:"rule"`
	Interface        opnsense.InterfaceList `xml:"interface,omitempty"          json:"interface,omitempty"        yaml:"interface,omitempty"`
	IPProtocol       string                 `xml:"ipprotocol,omitempty"         json:"ipProtocol,omitempty"       yaml:"ipProtocol,omitempty"`
	Protocol         string                 `xml:"protocol,omitempty"           json:"protocol,omitempty"         yaml:"protocol,omitempty"`
	Source           opnsense.Source        `xml:"source"                       json:"source"                     yaml:"source"`
	Destination      opnsense.Destination   `xml:"destination"                  json:"destination"                yaml:"destination"`
	ExternalPort     string                 `xml:"externalport,omitempty"       json:"externalPort,omitempty"     yaml:"externalPort,omitempty"`
	Target           string                 `xml:"target,omitempty"             json:"target,omitempty"           yaml:"target,omitempty"`
	InternalIP       string                 `xml:"internalip,omitempty"         json:"internalIP,omitempty"       yaml:"internalIP,omitempty"`
	InternalPort     string                 `xml:"internalport,omitempty"       json:"internalPort,omitempty"     yaml:"internalPort,omitempty"`
	LocalPort        string                 `xml:"local-port,omitempty"         json:"localPort,omitempty"        yaml:"localPort,omitempty"`
	Reflection       string                 `xml:"reflection,omitempty"         json:"reflection,omitempty"       yaml:"reflection,omitempty"`
	NATReflection    string                 `xml:"natreflection,omitempty"      json:"natReflection,omitempty"    yaml:"natReflection,omitempty"`
	AssociatedRuleID string                 `xml:"associated-rule-id,omitempty" json:"associatedRuleID,omitempty" yaml:"associatedRuleID,omitempty"`
	Priority         int                    `xml:"priority,omitempty"           json:"priority,omitempty"         yaml:"priority,omitempty"`
	NoRDR            opnsense.BoolFlag      `xml:"nordr,omitempty"              json:"noRDR,omitempty"            yaml:"noRDR,omitempty"`
	NoSync           opnsense.BoolFlag      `xml:"nosync,omitempty"             json:"noSync,omitempty"           yaml:"noSync,omitempty"`
	Disabled         opnsense.BoolFlag      `xml:"disabled,omitempty"           json:"disabled,omitempty"         yaml:"disabled,omitempty"`
	Log              opnsense.BoolFlag      `xml:"log,omitempty"                json:"log,omitempty"              yaml:"log,omitempty"`
	Descr            string                 `xml:"descr,omitempty"              json:"description,omitempty"      yaml:"description,omitempty"`
	Updated          *opnsense.Updated      `xml:"updated,omitempty"            json:"updated,omitempty"          yaml:"updated,omitempty"`
	Created          *opnsense.Created      `xml:"created,omitempty"            json:"created,omitempty"          yaml:"created,omitempty"`
	UUID             string                 `xml:"uuid,attr,omitempty"          json:"uuid,omitempty"             yaml:"uuid,omitempty"`
}

InboundRule represents a pfSense inbound NAT rule (port forwarding). This is a copy-on-write fork of opnsense.InboundRule because pfSense uses a <target> element for the internal redirect IP, whereas OPNsense uses <internalip>.

type Interface 

type Interface struct {
	Enable              opnsense.BoolFlag     `xml:"enable,omitempty"              json:"enable,omitempty"              yaml:"enable,omitempty"`
	If                  string                `xml:"if,omitempty"                  json:"if,omitempty"                  yaml:"if,omitempty"`
	Descr               string                `xml:"descr,omitempty"               json:"descr,omitempty"               yaml:"descr,omitempty"`
	Spoofmac            string                `xml:"spoofmac,omitempty"            json:"spoofmac,omitempty"            yaml:"spoofmac,omitempty"`
	InternalDynamic     int                   `xml:"internal_dynamic,omitempty"    json:"internalDynamic,omitempty"     yaml:"internalDynamic,omitempty"`
	Type                string                `xml:"type,omitempty"                json:"type,omitempty"                yaml:"type,omitempty"`
	Virtual             int                   `xml:"virtual,omitempty"             json:"virtual,omitempty"             yaml:"virtual,omitempty"`
	Lock                int                   `xml:"lock,omitempty"                json:"lock,omitempty"                yaml:"lock,omitempty"`
	MTU                 string                `xml:"mtu,omitempty"                 json:"mtu,omitempty"                 yaml:"mtu,omitempty"`
	IPAddr              string                `xml:"ipaddr,omitempty"              json:"ipaddr,omitempty"              yaml:"ipaddr,omitempty"`
	IPAddrv6            string                `xml:"ipaddrv6,omitempty"            json:"ipaddrv6,omitempty"            yaml:"ipaddrv6,omitempty"`
	Subnet              string                `xml:"subnet,omitempty"              json:"subnet,omitempty"              yaml:"subnet,omitempty"`
	Subnetv6            string                `xml:"subnetv6,omitempty"            json:"subnetv6,omitempty"            yaml:"subnetv6,omitempty"`
	Gateway             string                `xml:"gateway,omitempty"             json:"gateway,omitempty"             yaml:"gateway,omitempty"`
	Gatewayv6           string                `xml:"gatewayv6,omitempty"           json:"gatewayv6,omitempty"           yaml:"gatewayv6,omitempty"`
	BlockPriv           string                `xml:"blockpriv,omitempty"           json:"blockpriv,omitempty"           yaml:"blockpriv,omitempty"`
	BlockBogons         string                `xml:"blockbogons,omitempty"         json:"blockbogons,omitempty"         yaml:"blockbogons,omitempty"`
	DHCPHostname        string                `xml:"dhcphostname,omitempty"        json:"dhcphostname,omitempty"        yaml:"dhcphostname,omitempty"`
	Media               string                `xml:"media,omitempty"               json:"media,omitempty"               yaml:"media,omitempty"`
	MediaOpt            string                `xml:"mediaopt,omitempty"            json:"mediaopt,omitempty"            yaml:"mediaopt,omitempty"`
	DHCP6IaPdLen        int                   `xml:"dhcp6-ia-pd-len,omitempty"     json:"dhcp6IaPdLen,omitempty"        yaml:"dhcp6IaPdLen,omitempty"`
	Track6Interface     string                `xml:"track6-interface,omitempty"    json:"track6Interface,omitempty"     yaml:"track6Interface,omitempty"`
	Track6PrefixID      string                `xml:"track6-prefix-id,omitempty"    json:"track6PrefixId,omitempty"      yaml:"track6PrefixId,omitempty"`
	AliasAddress        string                `xml:"alias-address,omitempty"       json:"aliasAddress,omitempty"        yaml:"aliasAddress,omitempty"`
	AliasSubnet         string                `xml:"alias-subnet,omitempty"        json:"aliasSubnet,omitempty"         yaml:"aliasSubnet,omitempty"`
	DHCPRejectFrom      string                `xml:"dhcprejectfrom,omitempty"      json:"dhcprejectfrom,omitempty"      yaml:"dhcprejectfrom,omitempty"`
	DDNSDomainAlgorithm string                `xml:"ddnsdomainalgorithm,omitempty" json:"ddnsdomainalgorithm,omitempty" yaml:"ddnsdomainalgorithm,omitempty"`
	NumberOptions       []opnsense.DhcpOption `xml:"numberoptions,omitempty"       json:"numberoptions,omitempty"       yaml:"numberoptions,omitempty"`
	Range               opnsense.DhcpRange    `xml:"range,omitempty"               json:"range"                         yaml:"range,omitempty"`
	Winsserver          string                `xml:"winsserver,omitempty"          json:"winsserver,omitempty"          yaml:"winsserver,omitempty"`
	Dnsserver           string                `xml:"dnsserver,omitempty"           json:"dnsserver,omitempty"           yaml:"dnsserver,omitempty"`
	Ntpserver           string                `xml:"ntpserver,omitempty"           json:"ntpserver,omitempty"           yaml:"ntpserver,omitempty"`

	// Advanced DHCP fields for interfaces
	AdvDHCPRequestOptions                    string `` /* 158-byte string literal not displayed */
	AdvDHCPRequiredOptions                   string `` /* 159-byte string literal not displayed */
	AdvDHCP6InterfaceStatementRequestOptions string `` /* 177-byte string literal not displayed */
	AdvDHCP6ConfigFileOverride               string `` /* 163-byte string literal not displayed */
	AdvDHCP6IDAssocStatementPrefixPLTime     string `` /* 173-byte string literal not displayed */
}

Interface represents a pfSense network interface configuration. It is a copy-on-write fork of opnsense.Interface with Enable changed from string to BoolFlag, because pfSense uses presence-based <enable/> elements.

func (Interface) MarshalXML 

func (iface Interface) MarshalXML(e *xml.Encoder, start xml.StartElement) error

MarshalXML implements custom XML marshaling for Interface, ensuring that the Enable BoolFlag field is addressable so (*BoolFlag).MarshalXML is invoked. Without this, direct xml.Marshal calls on Interface values would fall back to default bool serialization instead of producing pfSense-compatible <enable/> elements. Uses a value receiver so both value and pointer marshaling work correctly.

type Interfaces 

type Interfaces struct {
	Items map[string]Interface `xml:",any" json:"interfaces,omitempty" yaml:"interfaces,omitempty"`
}

Interfaces contains the network interface configurations for a pfSense device. Uses a map-based representation where keys are interface identifiers (wan, lan, opt0, etc.).

func (*Interfaces) Get 

func (i *Interfaces) Get(key string) (Interface, bool)

Get returns an interface configuration by its key name (e.g., "wan", "lan", "opt0"). Returns the interface configuration and a boolean indicating if it was found.

func (*Interfaces) Lan 

func (i *Interfaces) Lan() (Interface, bool)

Lan returns the LAN interface if it exists, otherwise returns a zero-value Interface and false.

func (*Interfaces) MarshalXML 

func (i *Interfaces) MarshalXML(e *xml.Encoder, start xml.StartElement) error

MarshalXML implements custom XML marshaling for the Interfaces map.

func (*Interfaces) Names 

func (i *Interfaces) Names() []string

Names returns a sorted list of all interface names.

func (*Interfaces) UnmarshalXML 

func (i *Interfaces) UnmarshalXML(decoder *xml.Decoder, start xml.StartElement) error

UnmarshalXML implements custom XML unmarshaling for the Interfaces map.

func (*Interfaces) Wan 

func (i *Interfaces) Wan() (Interface, bool)

Wan returns the WAN interface if it exists, otherwise returns a zero-value Interface and false.

type MobileKey added in v1.4.0 

type MobileKey struct {
	Ident string `xml:"ident,omitempty" json:"ident,omitempty" yaml:"ident,omitempty"`
	// PreSharedKey is a sensitive credential. Excluded from JSON/YAML export to prevent
	// secret leakage — matching the pattern used on IPsecPhase1.PreSharedKey.
	PreSharedKey string `xml:"pre-shared-key,omitempty" json:"-" yaml:"-"`
}

MobileKey represents a mobile IPsec pre-shared key entry. MobileKey entries are listtags in pfSense config.xml.

type Nat 

type Nat struct {
	Outbound  opnsense.Outbound `xml:"outbound"            json:"outbound"            yaml:"outbound"`
	Inbound   []InboundRule     `xml:"rule"                json:"inbound,omitempty"   yaml:"inbound,omitempty"`
	Separator string            `xml:"separator,omitempty" json:"separator,omitempty" yaml:"separator,omitempty"`
}

Nat represents the pfSense NAT configuration. The key structural difference from OPNsense is that inbound (port-forward) rules are direct children of <nat> rather than nested under <nat><inbound>.

type SyslogConfig 

type SyslogConfig struct {
	FilterDescriptions string `xml:"filterdescriptions,omitempty" json:"filterDescriptions,omitempty" yaml:"filterDescriptions,omitempty"`
}

SyslogConfig represents the pfSense syslog configuration. It differs from OPNsense by including a filterdescriptions field.

type System 

type System struct {
	Optimization                  string             `xml:"optimization"                         json:"optimization,omitempty"                  yaml:"optimization,omitempty"`
	Hostname                      string             `xml:"hostname"                             json:"hostname"                                yaml:"hostname"`
	Domain                        string             `xml:"domain"                               json:"domain"                                  yaml:"domain"`
	DNSAllowOverride              int                `xml:"dnsallowoverride"                     json:"dnsAllowOverride,omitempty"              yaml:"dnsAllowOverride,omitempty"`
	DNSServers                    []string           `xml:"dnsserver"                            json:"dnsServers,omitempty"                    yaml:"dnsServers,omitempty"`
	DNS1GW                        string             `xml:"dns1gw,omitempty"                     json:"dns1gw,omitempty"                        yaml:"dns1gw,omitempty"`
	DNS2GW                        string             `xml:"dns2gw,omitempty"                     json:"dns2gw,omitempty"                        yaml:"dns2gw,omitempty"`
	Language                      string             `xml:"language"                             json:"language,omitempty"                      yaml:"language,omitempty"`
	Group                         []Group            `xml:"group"                                json:"groups,omitempty"                        yaml:"groups,omitempty"`
	User                          []User             `xml:"user"                                 json:"users,omitempty"                         yaml:"users,omitempty"`
	WebGUI                        WebGUI             `xml:"webgui"                               json:"webgui"                                  yaml:"webgui,omitempty"`
	SSH                           opnsense.SSHConfig `xml:"ssh"                                  json:"ssh"                                     yaml:"ssh,omitempty"`
	Timezone                      string             `xml:"timezone"                             json:"timezone,omitempty"                      yaml:"timezone,omitempty"`
	TimeServers                   string             `xml:"timeservers"                          json:"timeServers,omitempty"                   yaml:"timeServers,omitempty"`
	DisableNATReflection          string             `` /* 127-byte string literal not displayed */
	DisableSegmentationOffloading int                `` /* 136-byte string literal not displayed */
	DisableLargeReceiveOffloading int                `` /* 136-byte string literal not displayed */
	IPv6Allow                     string             `xml:"ipv6allow"                            json:"ipv6Allow,omitempty"                     yaml:"ipv6Allow,omitempty"`
	MaximumTableEntries           string             `` /* 126-byte string literal not displayed */
	CryptoHardware                string             `xml:"crypto_hardware,omitempty"            json:"cryptoHardware,omitempty"                yaml:"cryptoHardware,omitempty"`
	EnableSerial                  opnsense.BoolFlag  `xml:"enableserial,omitempty"               json:"enableSerial"                            yaml:"enableSerial,omitempty"`
	AlreadyRunConfigUpgrade       opnsense.BoolFlag  `` /* 130-byte string literal not displayed */
	NextUID                       int                `xml:"nextuid"                              json:"nextUid,omitempty"                       yaml:"nextUid,omitempty"`
	NextGID                       int                `xml:"nextgid"                              json:"nextGid,omitempty"                       yaml:"nextGid,omitempty"`
	PowerdACMode                  string             `xml:"powerd_ac_mode"                       json:"powerdAcMode,omitempty"                  yaml:"powerdAcMode,omitempty"`
	PowerdBatteryMode             string             `xml:"powerd_battery_mode"                  json:"powerdBatteryMode,omitempty"             yaml:"powerdBatteryMode,omitempty"`
	PowerdNormalMode              string             `xml:"powerd_normal_mode"                   json:"powerdNormalMode,omitempty"              yaml:"powerdNormalMode,omitempty"`
	Bogons                        struct {
		Interval string `xml:"interval" json:"interval,omitempty" yaml:"interval,omitempty"`
	} `xml:"bogons"                               json:"bogons"                                  yaml:"bogons,omitempty"`
}

System contains the pfSense system configuration. It mirrors the OPNsense System struct but with pfSense-specific differences: multiple DNS servers, bcrypt-hash user passwords, and additional system fields.

func NewSystem 

func NewSystem() System

NewSystem returns a System with all slice fields initialized for safe use.

type UnboundConfig 

type UnboundConfig struct {
	Enable                    opnsense.BoolFlag `xml:"enable,omitempty"                        json:"enable"                              yaml:"enable,omitempty"`
	DNSSEC                    opnsense.BoolFlag `xml:"dnssec,omitempty"                        json:"dnssec"                              yaml:"dnssec,omitempty"`
	ActiveInterface           string            `xml:"active_interface,omitempty"              json:"activeInterface,omitempty"           yaml:"activeInterface,omitempty"`
	OutgoingInterface         string            `xml:"outgoing_interface,omitempty"            json:"outgoingInterface,omitempty"         yaml:"outgoingInterface,omitempty"`
	CustomOptions             string            `xml:"custom_options,omitempty"                json:"customOptions,omitempty"             yaml:"customOptions,omitempty"`
	HideIdentity              opnsense.BoolFlag `xml:"hideidentity,omitempty"                  json:"hideIdentity"                        yaml:"hideIdentity,omitempty"`
	HideVersion               opnsense.BoolFlag `xml:"hideversion,omitempty"                   json:"hideVersion"                         yaml:"hideVersion,omitempty"`
	DNSSECStripped            opnsense.BoolFlag `xml:"dnssecstripped,omitempty"                json:"dnssecStripped"                      yaml:"dnssecStripped,omitempty"`
	Port                      string            `xml:"port,omitempty"                          json:"port,omitempty"                      yaml:"port,omitempty"`
	SSLPort                   string            `xml:"sslport,omitempty"                       json:"sslPort,omitempty"                   yaml:"sslPort,omitempty"`
	SSLCertRef                string            `xml:"sslcertref,omitempty"                    json:"sslCertRef,omitempty"                yaml:"sslCertRef,omitempty"`
	SystemDomainLocalZoneType string            `` /* 131-byte string literal not displayed */
}

UnboundConfig represents the pfSense Unbound DNS resolver configuration. It includes more fields than the OPNsense Unbound type, covering interface bindings, security options, and port configuration.

type User 

type User struct {
	Name           string            `xml:"name"           json:"name"                     yaml:"name"`
	Disabled       opnsense.BoolFlag `xml:"disabled"       json:"disabled"                 yaml:"disabled"`
	Descr          string            `xml:"descr"          json:"description,omitempty"    yaml:"description,omitempty"`
	Scope          string            `xml:"scope"          json:"scope"                    yaml:"scope"`
	Groupname      string            `xml:"groupname"      json:"groupname"                yaml:"groupname"`
	BcryptHash     string            `xml:"bcrypt-hash"    json:"bcryptHash"               yaml:"bcryptHash"`
	UID            string            `xml:"uid"            json:"uid"                      yaml:"uid"`
	Priv           []string          `xml:"priv,omitempty" json:"priv,omitempty"           yaml:"priv,omitempty"`
	Expires        string            `xml:"expires"        json:"expires,omitempty"        yaml:"expires,omitempty"`
	AuthorizedKeys string            `xml:"authorizedkeys" json:"authorizedKeys,omitempty" yaml:"authorizedKeys,omitempty"`
}

User represents a pfSense user. The critical difference from OPNsense is the use of bcrypt-hash instead of password, and user-level privileges via the Priv field.

type WebGUI 

type WebGUI struct {
	Protocol          string            `xml:"protocol"                    json:"protocol"                   yaml:"protocol"`
	SSLCertRef        string            `xml:"ssl-certref,omitempty"       json:"sslCertRef,omitempty"       yaml:"sslCertRef,omitempty"`
	LoginAutocomplete opnsense.BoolFlag `xml:"loginautocomplete,omitempty" json:"loginAutocomplete"          yaml:"loginAutocomplete,omitempty"`
	MaxProcesses      string            `xml:"max_procs,omitempty"         json:"maxProcesses,omitempty"     yaml:"maxProcesses,omitempty"`
	DashboardColumns  string            `xml:"dashboardcolumns,omitempty"  json:"dashboardColumns,omitempty" yaml:"dashboardColumns,omitempty"`
	WebGUICSS         string            `xml:"webguicss,omitempty"         json:"webguiCss,omitempty"        yaml:"webguiCss,omitempty"`
	LoginCSS          string            `xml:"logincss,omitempty"          json:"loginCss,omitempty"         yaml:"loginCss,omitempty"`
	AltHostnames      string            `xml:"althostnames,omitempty"      json:"altHostnames,omitempty"     yaml:"altHostnames,omitempty"`
}

WebGUI represents the pfSense WebGUI configuration. It extends the OPNsense WebGUIConfig with pfSense-specific fields such as dashboard columns, CSS theme, login CSS, and alternate hostnames.

type Widgets 

type Widgets struct {
	Sequence    string `xml:"sequence,omitempty"     json:"sequence,omitempty"    yaml:"sequence,omitempty"`
	ColumnCount string `xml:"column_count,omitempty" json:"columnCount,omitempty" yaml:"columnCount,omitempty"`
	Period      string `xml:"period,omitempty"       json:"period,omitempty"      yaml:"period,omitempty"`
}

Widgets represents the pfSense dashboard widgets configuration. It extends the OPNsense Widgets with a pfSense-specific refresh period field.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.