Install and Secure FreeBSD 15.1 on a VPS: SSH, pkg, Firewall, and Updates

A new FreeBSD server needs more than a working login before you put it online. This FreeBSD 15.1 VPS setup guide walks you through installation, SSH keys, package management, time sync, and system updates. Also, you will learn to set up a PF firewall with an automatic rollback, so a wrong rule does not leave you locked out.

Before you start, check that your VPS or dedicated server supports FreeBSD 15.1. Make network details ready, and make sure you can open the provider’s console if SSH stops working. Also, back up any existing data before installing. 

There are two installation paths:

1. Provider image: select a FreeBSD 15.1 image that your provider supports. Follow its first-login instructions and check how it updates the base system.
2. Manual installation: use an official ISO through virtual media or a remote console. Confirm disk, network, and boot support. An official ISO does not make a manual installation provider-supported.

PerLod’s Linux VPS hosting uses KVM virtualization and lists FreeBSD as an available operating system. Confirm that FreeBSD 15.1 is available for your chosen plan before ordering.

For a manual FreeBSD 15.1 VPS setup, you must download the amd64 disc1.iso and its matching SHA256 checksum file from FreeBSD’s official download site. On a Linux workstation, check the download:

The ISO must report OK. Attach it through the provider’s panel, boot it, and choose Install. Follow these installer choices:

1. Select your keyboard and set a hostname, such as bsd1.example.com.
2. Select Distribution Sets for the traditional, supported installation path used below. Package-based installs use a different update path.
3. Skip optional source, debug, and Ports files unless needed.
4. Choose Auto (UFS), GPT, and the correct disk. Entire Disk erases that disk. Auto (ZFS) is another option if you want boot environments.
5. Set a strong root password.
6. Configure the detected network interface using DHCP only if the provider supports it. Otherwise, enter its exact static settings.
7. Choose a timezone and enable sshd and ntpd. Create an admin user in the wheel group, or create one later.
8. Finish, detach the ISO, and reboot.

Remember to use the exact network settings from your provider.

Open your provider’s console and log in as root. If you use a provider image, follow its instructions to get root access. Run the commands below as root, and use /bin/sh so they work as shown:

For this FreeBSD 15.1 VPS setup, the output should show 15.1-RELEASE, sometimes followed by a patch number. The kernel and system files may have different patch numbers. This alone does not mean something is wrong.

Check that the IP address, network interface, gateway, and DNS settings match your provider’s details. If the fetch command works, DNS and HTTPS are working. If it fails, check your network settings and system time before moving on.

Also, you can enable SSH if needed with the commands below:

Before accepting your first SSH connection, check that the fingerprint shown on your computer matches the one on the server.

At this point, you must create an admin user for daily tasks instead of logging in as root. Then, add your SSH public key so you can log in with your key instead of a password.

The user’s groups should include wheel, which lets you use su to become root. Keep a strong account password, even if password login over SSH is turned off.

On your computer, create an SSH key if you do not have one. If you already have a key, do not replace it:

Set a passphrase to protect your private key. Then, run these commands in the server console:

Replace the placeholder with your full public key, not your private key. Save it in the user’s authorized_keys file to allow SSH key login.

Now test this FreeBSD 15.1 VPS setup from a second terminal:

When su asks for a password, enter the root password. The whoami command should show root. Keep the server console and your first SSH session open.

Now that your SSH key works, you can turn off root login and password login over SSH. Keep your current session and server console open until you have tested a new connection.

Back up the server configuration and open the sshd config file:

Set these options before any Match block. If an option is already there, change it instead of adding it again:

Once you are done, save and close the file. Check syntax and settings:

The syntax check should show no output. The active settings should match the values above. Also, check any files loaded with Include and any Match rules.

Before closing your sessions, open a new SSH connection using only your key, then test su -. Turning off SSH password login does not change your account passwords.

Now you must set your server’s timezone and enable NTP to keep its clock correct. Then, set up pkg to install and manage software.

Keep the default /etc/ntp.conf unless your provider asks you to use different time servers. After a few minutes, run ntpq -pn. It should list available time servers, with * next to the one in use. Make sure your provider’s firewall allows outgoing NTP traffic.

Bootstrap pkg, then check its settings:

If asked to install pkg, accept the prompt. Some images already have it installed. Run pkg -vv to check which repositories are enabled and their URLs. Keep the default official settings unless you need to change them.

The quarterly repository provides a steadier set of package versions, while latest gets new versions sooner. Repository names may differ, so check old examples before using them.

If installation fails, check DNS, the server’s time, HTTPS access, and whether your FreeBSD release is still supported. Do not turn off signature checks or force packages built for a different system.

This FreeBSD 15.1 VPS setup is for a new server with PF turned off. Do not use these rules to replace an existing firewall or gateway setup. Keep your provider’s console open, as a wrong PF rule can block SSH access.

Run route -n get default to find your network interface. Replace vtnet0 below with that interface name, then create /etc/pf.conf:

If the syntax check shows no output, it passed. These rules allow outgoing connections, incoming SSH, ICMP checks, IPv6 control traffic, and IPv4 DHCP replies. Other incoming traffic stays blocked. If your provider uses DHCPv6, add its required rules. These rules are for a server, not a router.

Before turning on PF, set a five-minute rollback timer to turn it off automatically:

You should see Status: Enabled and your firewall rules. The timer turns PF off; it does not bring back old rules. Do not reboot during the test.

Open a new SSH connection immediately, switch to root, and run this test:

If something fails, wait for the timer to turn PF off, or run pfctl -d from the server console. Fix the rules, then test again with a new timer. Your existing SSH session may still work even if new connections are blocked.

Once the checks pass, cancel the timer and set PF to start at boot:

After five minutes, check that PF is still on. Use a rollback timer whenever you change firewall rules. Also, make sure your provider’s firewall allows TCP port 22 for SSH.

At this point, you must update the system and installed packages, then reboot if needed. After the server restarts, check that SSH, time sync, and the firewall still work.

If you chose Distribution Sets during installation, run:

If your provider’s image uses pkgbase, update it through its base repository, not freebsd-update:

Installed FreeBSD-* system packages can help you check whether the image uses pkgbase. Confirm this in the image’s documentation. An enabled repository alone does not prove it, and the base repository may have a different name. Read each update prompt before accepting it.

After updating, reboot if needed. Make sure you can open the server console first:

Reconnect and check:

Check that the services are running, PF is on, and pkg audit -F reports no known security issues. Check which services are listening for connections and turn off any you do not need. You still need to install security updates for the base system.

Your FreeBSD 15.1 VPS setup now has a tested admin login, key-only SSH, time sync, package management, a basic firewall, and a clear update path. Keep off-server backups and schedule regular checks.

If you later need a physical server, you can explore dedicated server hosting plans. Before ordering, ask the provider if it supports FreeBSD, lets you install from an ISO, and offers recovery access.