Fresh install finished, dashboard open - and no internet anywhere. Nine times out of ten the cause is physical or addressing, not the firewall itself.
Stay calm and work in order. A pfSense with no internet after setup is almost always one of four things: the WAN and LAN cables are swapped, both sides share the same subnet, the modem has not accepted the new device, or DHCP is handing clients the wrong gateway. This page checks them in the order that finds the fault fastest, starting with the test that needs no tools at all.
The console interface list during assignment - the unplug test identifies each port beyond doubt. Interface names vary by hardware.
Before touching a single cable, log in and check the gateway status. If the WAN gateway itself is Offline, pfSense cannot reach the internet either - the fault is between pfSense and your ISP, and no rule or setting on the LAN side will fix it. If WAN is Online but PCs have no internet, the fault is on your side - addressing or DNS. Two different problems, two different fixes.
This is the most common fresh-install failure and it produces no error message at all. During interface assignment it is easy to name the ports in the wrong order, especially when both cables look identical. The result: your PCs are plugged into the internet side and the modem is plugged into the office side.
pfSense is born with LAN address 192.168.1.1, and most ISP routers use exactly the same address. If both sides of pfSense live on 192.168.1.0 / 24, it cannot route between them - like a lift told both floors have the same number. Change the pfSense LAN to a fresh subnet such as 192.168.10.1 / 24, as shown in the setup video, then reconnect your PC to the new address.
If the WAN interface gets no IP address from the modem, try the boring fix first - power-cycle the modem. Many modems remember the previous device they were connected to and refuse the new one until restarted. If your ISP uses PPPoE, pfSense needs the ISP username and password entered on the WAN settings; the plain DHCP default will sit at no address forever without them.
If the gateway is Online and you can ping the internet from pfSense itself (Diagnostics - Ping), the firewall is fine and the problem is what pfSense hands to clients. Check the DHCP server on LAN: clients should receive pfSense's LAN address as their gateway, and a working DNS server. A wrong gateway typed into a static client is the same failure wearing a smaller hat.
If pfSense sits behind the ISP router (router into router), you have double NAT. Honest grading: ordinary browsing and office work usually run fine. It mainly complicates incoming connections - hosting a server, some VPN setups, some games. Removing it means putting the ISP router into bridge mode where the ISP allows it. Do not chase it on day one if everything the office needs is working.
The setup video shows the correct WAN and LAN assignment and the gateway check on a clean install - compare your box against it.
Watch Full VideoUse the unplug test at the console: open Assign interfaces, pull one cable out, and watch which interface reports down. That is the port connected to the cable in your hand. Label both ports with tape afterwards - every experienced admin does.
Most often the modem has not let go of the previous device - power-cycle the modem with pfSense already connected. If your ISP uses PPPoE, pfSense also needs the ISP username and password on the WAN interface; without them it will wait forever.
Change the pfSense LAN, not the router. Pick a different private subnet such as 192.168.10.1 / 24 during or after setup, then reconnect to the new address. Two identical subnets on WAN and LAN cannot be routed between, and the failure looks like random breakage until you spot it.