BEFORE YOU DEPLOY
Frequently asked questions.
What are the system requirements?
Install on a fresh Ubuntu Server 26.04 LTS, amd64 (x86-64) VM or server with systemd and root/sudo access. Allocate at least 8 GiB RAM; 16 GiB RAM and 4 vCPUs are a practical starting point. Provide at least 40 GiB free system disk plus persistent log storage sized for your event rate and retention. Larger fleets and heavy reporting require additional resources; these figures are not a 1,000-device sizing guarantee.
Host FWMS on your own infrastructure or in AWS, Microsoft Azure, or Google Cloud Compute, using an Ubuntu Server 26.04 amd64 virtual machine with persistent storage and the required network access. Virtualization has been tested on VMware, VirtualBox, and Hyper-V. The guest OS, architecture, resources, and connectivity requirements apply on every platform; ARM instances and managed application hosting are not equivalent to a supported Ubuntu amd64 VM.
You need a stable server address, a DNS hostname, trusted HTTPS, internet access for installation and licensing, and access to an SMTP relay for invitations and notifications. Publish TCP 443 for the portal and TCP 6514 for encrypted logs. Allow outbound access to your firewalls' SSH and API HTTPS ports. Mount any separate log volume before installation. Do not expose internal database or ELK service ports publicly.
Recommended log storage for 30 days
Client counts are per firewall. Recommended TiB is the total storage for all firewalls, estimated for 30 days of logs.
| # of Firewalls | # of clients using firewall | # of TiB recommended |
|---|---|---|
| 1 | 25 | 0.25 |
| 5 | 50 | 0.5 |
| 20 | 50 | 2 |
| 50 | 100 | 8 |
| 200 | 100 | 32 |
| 1,000 | 100 | 160 |
For example: managing 20 locations with one firewall and about 50 connected devices at each? Start planning for a 2 TiB log volume. This is shared server storage, not a separate 2 TiB volume for every firewall.
These are planning estimates. Busy networks and detailed website, DNS, or intrusion logging can need much more space. Start with a few representative firewalls, measure actual growth, and adjust before expanding. The log drive is separate from the Ubuntu system disk and backups.
Technical assumptions and calculation
The examples assume 0.2 sustained logged events/second per connected device, 2 KiB of indexed storage per event, 30 days, no replicas, and 70% target disk utilization (30% free headroom). These are modeling assumptions, not measured FWMS benchmarks. TiB uses binary capacity: 1 TiB equals 1,024 GiB.
Provisioned TiB = events/sec × 86,400 × days × indexed bytes/event ÷ 0.70 ÷ 1,099,511,627,776. For the 20-firewall example: 1,000 connected devices × 0.2 = 200 events/sec, requiring about 1.38 TiB including headroom, rounded up to a 2 TiB log volume.
Double the event rate, indexed event size, or retention and the calculated storage doubles. One Elasticsearch replica approximately doubles indexed storage. Capacities are usable disk space before RAID overhead and exclude the OS, external snapshots/backups, and any extra retained log copy. The model follows Elastic's event-volume sizing approach; these recommendations are FWMS planning examples.
Measure indexed growth and event volume for 24–72 representative hours, including busy periods. Large fleets require ELK heap, container limits, indexing, I/O, and query tuning; more host RAM does not automatically resize containers. This table does not enable automatic 30-day deletion. Establish and verify retention separately; the default does not enforce a 30-day cap.
Which firewalls are supported?
FWMS currently targets pfSense CE. Automatic API installation is validated on CE 2.8.1 and 2.9.0; other versions require compatible API validation. Available controls vary by release and installed packages. OPNsense is not a released, validated management target.
Where are the installation and operating instructions?
Sign in to your store account and open Customer documentation for installation, licensing, firewall enrollment, secure logging, SMTP, branding, users, reports, and troubleshooting. Paid live subscriptions provide the installer and license in My account.