One REST API key on the firewall gives SmartTile the pfSense view a NOC needs — system health, WAN gateway latency and loss with failover history, interface bandwidth, VPN tunnels and on-demand config.xml backups — and an up/down check that still works when the firewall sits behind someone else's router.
X-API-Key over HTTPS.A pfSense firewall behind a customer's own router often will not answer ping, so a ping-only monitor either shows it down for ever or shows nothing but up/down. The pfSense REST API answers the questions a NOC actually asks — is the WAN gateway dropping packets, did it fail over, which tunnels are up, what changed in the config. SmartTile connects per company with that company's own key, polls it on a schedule, and puts the firewall on the same /devices pane as the rest of the network.
Connect My Network pings the firewall once: if it answers, ping is the check; if not, the API poll is the heartbeat. Three failed polls in a row mark it DOWN; a good poll brings it back UP.
An API-monitored firewall going DOWN is written to state history (so Uptime and availability include it) and opens a Rev.io ticket when auto-ticketing is on for the device. Snoozes and per-device ticket delays are honoured.
Every poll stores each gateway's latency, jitter (stddev) and loss, kept 35 days. A gateway changing status is recorded as a failover event, shown in the Analytics modal.
Per-interface in/out byte and error counters are accrued each poll and turned into throughput graphs in the Bandwidth modal — WAN flagged — with 35 days of history.
CPU, memory, swap, disk, temperature, mbuf and uptime; services that are enabled but stopped; DNS resolver state; DHCP leases; CARP / HA and maintenance mode.
The VPN button reads IPsec SAs (phase 2, subnets, bytes, IKE version), OpenVPN servers with connected sessions, and the WireGuard tunnel count, live from the firewall.
Backup Now pulls the full config.xml, masks passwords, keys, PSKs and SNMP communities, and stores a version in the device's Config Backups list — only when it has changed.
Vendor (Netgate), model, serial and pfSense version are written to the device record through the shared identity writer — blanks filled, a manual edit never overwritten.
pkg-static add …/pfSense-2.8.1-pkg-RESTAPI.pkg; pfSense Plus: the asset for your version from github.com/pfrest/pfSense-pkg-RESTAPI/releases.157.245.117.9 to the web GUI port over HTTPS. Behind another router, port-forward that HTTPS port to the firewall. Ping is not required.https://203.0.113.10:10443), key, location, then Connect firewall. It tests the key, polls once and imports the device.| Choice | What happens |
|---|---|
| Automatic (recommended) | One ping probe: answers → ping monitoring; no answer → pfSense API monitoring. No false DOWN behind NAT. |
| Ping | Standard ICMP monitoring of the firewall address; the API still feeds graphs and health. |
| pfSense API | The API poll is the heartbeat: DOWN after 3 consecutive failed polls, UP on the next good one. |
| Self-signed certificate | Untick "trusted TLS certificate"; SmartTile then accepts the firewall's own cert. HTTPS is always required. |
/api/v2/status/systemCPU, memory, disk, temp, uptime, serial, platform/api/v2/system/versionpfSense version (also the Test call)/api/v2/status/gatewaysgateway latency, stddev, loss, status/api/v2/status/interfacesinterface state + byte/error counters/api/v2/status/carpCARP / HA and maintenance mode/api/v2/status/servicesservices enabled but stopped, DNS resolver/api/v2/status/ipsec/sasIPsec tunnels and phase 2/api/v2/status/openvpn/serversOpenVPN servers and sessions/api/v2/vpn/wireguard/tunnelsWireGuard tunnels (if the package is installed)/api/v2/status/dhcp_server/leasesDHCP lease counts/api/v2/diagnostics/config_history/revisionslast 10 config changes (Analytics)/api/v2/system/restapi/versionREST package version / update available/api/v2/diagnostics/command_promptonly cat /cf/conf/config.xml, only on Backup NowEvery monitoring call is a GET. The only POST runs one fixed command — cat /cf/conf/config.xml — and only when someone presses Backup Now. SmartTile never changes a rule or setting.
Encrypted at rest (AES-256-GCM) on save. The API returns only whether a key is set; the edit form shows dots, never the key. It travels only in the X-API-Key header over HTTPS.
Each company connects its own firewalls. Admins see and change only firewalls in their own company; the device's Uptime, Bandwidth, VPN and Backup routes check tenant ownership.
Passwords, hashes, pre-shared keys, private keys, API keys and SNMP communities are replaced with MASKED before the backup is hashed or stored.
| Change | Risk | Rollback |
|---|---|---|
| Install the pfSense REST API package | Low — adds an API to the web GUI; no traffic or policy change. | Remove the package. |
| Create one REST API key as an admin user | The key can call the API; SmartTile uses it for reads and the one backup command. | Delete the key under System → REST API → Keys; access ends at once. |
| WAN rule for 157.245.117.9 to the GUI port (and a port-forward if behind NAT) | Low — one source address to the existing GUI port. | Remove the rule / forward. |
| Objection | Answer |
|---|---|
| "Our firewall does not answer ping." | It does not need to. Automatic mode detects that and monitors through the API — the reason this flow exists. |
| "Will you change our configuration?" | No. Monitoring is reads only; the backup command only reads config.xml, and only when a person presses Backup Now. |
| "Does a blip page us?" | No. The firewall turns DOWN only after 3 consecutive failed polls, and a restart of SmartTile never fires a false DOWN on its first poll. |
| "We use a self-signed certificate." | Fine — untick the trusted-certificate box. The connection is still HTTPS. |