Support · FireGlance
FireGlance Support
Getting started
FireGlance is a read-only iPhone dashboard for pfSense® firewalls. It reads status from the free, open-source pfSense REST API package ("pfREST"), which you install on the firewall. pfSense CE has no built-in REST API, so FireGlance cannot connect without it.
- Try Demo mode first: tap Try Demo Mode on the welcome screen. Every tab shows realistic sample data with no firewall, including previews of the Pro log viewer and Home Screen widget.
- On the firewall, install pfREST from the firewall's shell (SSH or Diagnostics > Command Prompt): run the
pkg-static addcommand for your pfSense version from the pfrest.org install guide. It is not in System > Package Manager. The API is on by default; its settings are under System > REST API. - Create an API key on the firewall under System > REST API > Keys. A username and password also work for local-database pfSense users, but an API key is recommended.
- In FireGlance, tap Add My Firewall and enter the same host and port you use for the webConfigurator (HTTPS on port 443 by default). When iOS asks to find and connect to devices on your local network, tap Allow.
- Tap Test Connection. If the firewall uses a self-signed certificate, compare its SHA-256 fingerprint and approve it once.
After every pfSense upgrade, reinstall pfREST. pfREST is not an official Netgate package, and pfSense removes unofficial packages when it updates. If FireGlance reports "REST API package not found" right after an upgrade, reinstall the package from pfrest.org. If the old API key no longer works afterwards, create a new one under System > REST API > Keys.
Frequently asked
FireGlance can't connect. What do I check first?
1) Is the pfREST package installed? If FireGlance reports "REST API package not found", the firewall's web interface answered instead of the API. Install pfREST, or reinstall it if you just upgraded pfSense. 2) Is the address right? Use the same host and port as the webConfigurator (usually HTTPS on 443, sometimes 8443), and keep Use HTTPS on: FireGlance will not send an API key or password over plain HTTP. 3) Can your iPhone reach the firewall? FireGlance talks directly to it, so be on the LAN or connected via VPN. 4) Did you allow Local Network access? If you tapped Don't Allow, turn it on in iOS Settings > Privacy & Security > Local Network > FireGlance. 5) Is the API key valid? Create one under System > REST API > Keys.
It says the certificate isn't trusted / shows a fingerprint
That's expected: pfSense boxes almost always use self-signed certificates. When iOS does not already trust the certificate, FireGlance shows its SHA-256 fingerprint and asks you to approve it once per firewall. To verify it matches, check System > Certificates on the firewall and compare the SHA-256 digest. After approval the fingerprint is pinned, and FireGlance accepts only that exact certificate for that firewall.
The fingerprint changed and FireGlance refuses to connect
This protects you from man-in-the-middle attacks. If you changed the certificate yourself (renewed or regenerated it), open Settings > Firewalls, tap the edit control next to the firewall, tap Remove pinned certificate, then Test Connection and approve the new fingerprint. If you did not change it, investigate before trusting. The same applies if you move a pinned firewall to a publicly trusted certificate (for example from Let's Encrypt via ACME): FireGlance keeps refusing it until you remove the pinned certificate.
What's free and what's Pro?
Free for one firewall: the full dashboard, interfaces, gateways, services, and DHCP leases. Pro ($9.99, one-time, never a subscription) adds multiple firewalls, the firewall-log viewer, on-device alerts, and Home Screen widgets. To restore a previous purchase, open Settings > Pro > See what's in Pro and tap Restore Purchases. Restore shows no message of its own: when it works, the Pro section in Settings shows Pro unlocked. If it still says Free plan, wait a minute with internet access and try again.
Does Pro work with Family Sharing?
No. FireGlance Pro is not shared through Family Sharing; each Apple Account buys its own.
What happens if I get a refund?
Refunds are handled by Apple at reportaproblem.apple.com; we cannot issue them. After a refund your saved firewalls and settings stay on your iPhone, and Pro features lock: FireGlance goes back to the free plan and monitors only your first firewall, and the log viewer, alerts and Home Screen widget stop until you buy or restore Pro.
How do alerts work?
Alerts are part of Pro. Turn them on at Settings > Alerts; FireGlance asks for notification permission at that point. iOS wakes FireGlance in the background from time to time (iOS chooses when, so timing is not exact), FireGlance checks your firewall once, and a local notification fires when the firewall becomes unreachable, a gateway goes down, latency or packet loss runs high, a WAN interface goes down, or CPU or temperature runs high, and another when FireGlance sees that condition healthy again. While FireGlance can't reach the firewall, an active alert stays active: no recovery notice is sent until it can read the firewall again. Everything runs on your iPhone: no push servers, no account. Your iPhone has to be able to reach the firewall (LAN or VPN) for a check to work. Demo mode never sends notifications.
Why does the widget show 0 throughput?
Widgets are part of Pro. The medium widget shows an "as of" time, and the small one shows it when the data is old. After a background check, download and upload throughput show 0, because a single check cannot measure a rate. Open FireGlance for live throughput; the widget picks it up from the app. There is no Lock Screen widget in FireGlance 1.0.
Does FireGlance change anything on my firewall?
No. v1 is strictly read-only. It sends only read requests; it cannot edit rules, restart services, or modify configuration.
Which pfSense versions work?
pfSense versions supported by the pfREST v2 package (see pfrest.org for its compatibility table). FireGlance uses the /api/v2 endpoints.
Is my data collected?
No. Forgehaven Labs collects no data from FireGlance: no analytics, no accounts, no third-party SDKs, and no server of ours. Your API key or password is stored in the iOS Keychain on your iPhone and is sent only to the firewall you configured. See the privacy policy.
Reporting a bug
Email [email protected] with your iPhone model and iOS version, your pfSense version and pfREST package version, and what you did, what you expected, and what happened. Screenshots are welcome; mask any public IPs.
FireGlance is an independent project, not affiliated with, endorsed by, or supported by Netgate. pfSense is a registered trademark of Rubicon Communications, LLC (Netgate).