What you're doing when you connect pfSense to New Relic

New Relic is a monitoring platform that collects data from your network devices and shows you what's happening in real time. When you connect pfSense — your firewall and router — to New Relic, you send information about traffic, blocked connections, and system performance to New Relic's servers, where you can view it through a dashboard.

This connection requires three things: a New Relic account, the New Relic infrastructure agent installed on the machine running pfSense, and a way to authenticate that agent so New Relic knows the data is coming from your network. The process takes about 20 to 30 minutes if you follow the steps in order.

Why do this? You get visibility into what's crossing your network — which devices are using bandwidth, whether your firewall rules are working as intended, and whether the pfSense machine itself is running into CPU or memory problems. Without this, you're flying blind.

Key Takeaways

  • You need a New Relic account with an API key before you start; the free tier works for basic monitoring.
  • The New Relic infrastructure agent runs on the pfSense machine itself and sends data back to New Relic's servers.
  • pfSense typically runs on FreeBSD, not Linux, so you must use the FreeBSD version of the agent, not the Linux version.
  • After installation, data takes 5 to 10 minutes to appear in your New Relic dashboard; if nothing shows after 15 minutes, check the agent logs for errors.

Creating a New Relic account and finding your API key

Go to newrelic.com and click the sign-up button. You can use a free account; New Relic's free tier includes infrastructure monitoring. Enter your email, create a password, and complete the account setup. You do not need a credit card for the free tier.

Once you're logged in, look for the account menu — usually a gear icon or your name in the top right corner. Select API keys. You'll see a list of key types. Click Create key, choose Infrastructure as the key type, give it a name like "pfSense Monitoring", and copy the key that appears. Save this key somewhere safe; you'll need it when you install the agent on pfSense.

If you can't find the API keys section, look for Administration in the left sidebar, then API keys. The exact location varies slightly depending on your New Relic plan, but it's always under account settings.

Preparing your pfSense machine for the agent

Log into your pfSense web interface using your browser. The default address is usually 192.168.1.1 or 192.168.0.1, depending on your network setup. Use your pfSense admin credentials.

Go to System > Package Manager > Available Packages. Search for "newrelic" or scroll until you find the New Relic infrastructure package. Click the install icon next to it. pfSense will read and install the package, which takes a minute or two.

If you don't see a New Relic package in the package manager, you can install the agent manually through the command line. This requires SSH access to your pfSense box. If you're not comfortable with command-line access, stick with the package manager route — it's simpler and handles most setups.

Installing and configuring the New Relic agent

After the package installs, go to Services > New Relic Infrastructure. You'll see a configuration page. Paste your New Relic API key into the License Key field. Leave the other settings at their defaults unless you have a specific reason to change them.

Click Save. The system will write the configuration and start the agent. You should see a message saying the service is running. If you see an error, check that you copied the API key correctly — extra spaces or missing characters will cause the connection to fail.

The agent runs in the background and sends data to New Relic every 15 to 30 seconds. You don't need to do anything else; it will keep running even if you reboot pfSense, as long as you've saved the configuration.

Checking that data is arriving in New Relic

Go back to your New Relic account in your browser. Click Infrastructure in the left sidebar. Wait 5 to 10 minutes, then refresh the page. You should see your pfSense machine listed under Hosts. Click on it to see CPU, memory, disk, and network metrics.

If your pfSense machine doesn't appear after 15 minutes, the agent isn't connecting. Log back into pfSense and go to Services > New Relic Infrastructure. Look for a View Logs button or link. The logs will show you whether the agent is running and whether it's able to reach New Relic's servers. Common issues are a wrong API key, a firewall rule blocking outbound connections to New Relic, or the agent service not actually running.

If the logs show the agent is trying to connect but failing, check your pfSense firewall rules. New Relic's agent needs to reach infra-api.newrelic.com on port 443 (HTTPS). If you have outbound rules that block traffic by default, you'll need to add a rule allowing this connection.

Understanding what you're seeing in the dashboard

Once data arrives, New Relic shows you graphs of CPU usage, memory, disk I/O, and network traffic on your pfSense machine. The System tab gives you an overview. The Processes tab shows which processes are using the most resources — useful for spotting if something is consuming CPU unexpectedly.

The Network tab shows traffic in and out of each network interface. This tells you whether your WAN connection is saturated, whether your LAN is seeing heavy traffic, and whether there are any unusual patterns. If you see traffic spikes that don't match what you expect, that's a sign to investigate what's happening on your network.

You can set up alerts so New Relic notifies you if CPU usage stays above a certain threshold, or if the agent stops sending data. These are optional, but useful if you want to know when ready when something goes wrong rather than checking the dashboard manually.

Troubleshooting common connection problems

If the agent installs but data never appears, the most common cause is an incorrect API key. Double-check that you copied it exactly, with no extra spaces at the beginning or end. New Relic API keys are case-sensitive.

The second most common cause is an outbound firewall rule blocking the connection. If you have a rule that denies all outbound traffic by default, you need to add an allow rule for infra-api.newrelic.com on port 443. Go to Firewall > Rules > WAN and add a rule allowing HTTPS traffic to that destination.

If the agent service won't start, check that pfSense has enough free disk space and that the package installed completely. Sometimes a partial installation leaves the agent in a broken state. Try uninstalling the package from the package manager and reinstalling it.

If you see data arriving but it stops after a few hours, the agent may have crashed. Check the logs again. If you see repeated error messages, note them and search the New Relic documentation or community forums for that specific error — it usually points to a configuration problem or a known issue with a particular pfSense version.

Frequently Asked Questions

Do I need to pay for New Relic to monitor pfSense?

No. New Relic's free tier includes infrastructure monitoring for one host. If you're only monitoring your pfSense machine, the free account is sufficient. Paid plans add more hosts, longer data retention, and advanced features like custom dashboards and alerting policies.

Will monitoring pfSense slow it down?

The New Relic agent uses minimal CPU and memory — typically less than 1 percent of your pfSense machine's resources. On modern hardware, you won't notice any performance impact. On very old or underpowered pfSense boxes, the agent may use slightly more resources, but it's still negligible compared to the firewall's normal workload.

What if I'm running pfSense on a virtual machine?

The process is identical. The agent doesn't care whether pfSense is running on bare metal or in a VM. Install it the same way, and it will send the same data to New Relic.

Can I monitor multiple pfSense machines with one New Relic account?

Yes. Each pfSense machine gets its own API key, and each one sends data to the same New Relic account. You'll see all of them listed under Infrastructure > Hosts. The free tier covers one host, so you'd need a paid plan to monitor more than one.

What happens if my internet connection goes down?

The agent will try to reconnect to New Relic every few seconds. While you're offline, data won't be sent, but the agent keeps running. Once your connection comes back, it resumes sending data. You won't lose historical data; New Relic keeps what it received before the outage.