Create a firewall VM in a Cloud Pool

Launch pfSense or OPNsense from the same create wizard you use for other Cloud Pool VMs. The form changes for those families — options are listed in Firewall appliance templates (pfSense and OPNsense).

What you need

• An active Cloud Pool with free CPU, memory, and storage
• A public address for WAN (a Public IP Block on the pool Networks tab)
• A private network for LAN (create an SDN on Networks first if you do not have one)
• A technical-role user on the organization

You do not need SSH keys. Cloud-init is not used.

Steps

1. Open Compute → Cloud pools → your pool → Virtual machines → New VM.
2. Choose a pfSense or OPNsense image.
3. Set Name, then Machine size (vCPU, memory, storage) from remaining pool capacity.
4. Confirm Login credentials: username is admin (pfSense) or root (OPNsense). Password is the vendor default — change it after first login.
5. Under Network interfaces, keep two adapters (the wizard adds a second if needed):
   • WAN — typically Public IP Block, then pick an address.
   • LAN — typically SDN, then pick the private network. Leave the address blank to auto-assign, or type one. If the appliance will use the network gateway, the platform reserves it — set that address in the console on first boot.
6. Add more NICs if you need Optional 1, Optional 2, and so on.
7. Optionally attach a backup policy. Skip SSH keys and hypervisor firewalls — those controls are hidden.
8. Click Create machine.

Creation is queued. You land on the new VM's page.

First console login

1. Wait until the VM is running.
2. Open Web Console (see Start, stop, reset, and open the console).
3. Log in with the default username and the vendor default password.
4. Change the password.
5. Set WAN and LAN addresses in the appliance itself. The portal does not run the vendor's setup screens.

After create

The VM Firewall tab shows only the appliance explanation — no enabled toggle and no Add rule. Put other VMs behind this appliance with Put a VM behind an external firewall.

Tips

• Create the LAN SDN on the pool Networks tab before you open the wizard.
• Size for the appliance's own needs; guests behind it are separate VMs.
• Prefer console until WAN is up — SSH-key inject never runs for these templates.

Related guides

• Firewall appliance templates (pfSense and OPNsense)
• Put a VM behind an external firewall
• Networks in Cloud Pools
• Firewalls for Cloud Pools

Still stuck?

Open a support ticket from Support → Tickets if create stays on "creating", the console never connects, or WAN/LAN addresses cannot be set after first boot.