Open Source

How to Change DNS on pfSense

By [FILL IN], [FILL IN] · Last updated 2026-10-03

pfSense runs Unbound as DNS resolver. Switch it to forwarding mode with FirewallDNS upstream.

Before you start

You need a FirewallDNS account (see pricing). Sign in to your dashboard, register your public IP address and copy your DNS server addresses. Replace <FIREWALLDNS-PRIMARY> and <FIREWALLDNS-SECONDARY> below with them.

Step by step

System > General Setup: add <FIREWALLDNS-PRIMARY> and <FIREWALLDNS-SECONDARY> under DNS Servers. Untick "Allow DNS server list to be overridden by DHCP/PPP on WAN".
Services > DNS Resolver: tick "Enable Forwarding Mode". Save and Apply.
Services > DHCP Server > LAN: leave DNS empty (clients use pfSense) or enter the FirewallDNS addresses.
Firewall > NAT > Port Forward: redirect LAN port 53 to 127.0.0.1 to catch hard-coded DNS.

Verify it works

Renew DHCP on a client (Windows: ipconfig /renew, macOS: reconnect Wi-Fi).
Run nslookup example.com and check which server answered.
Open the live log in your dashboard. New lookups should appear within seconds.

Learn more

Not protected yet?

FirewallDNS costs $2.90 per device per month.