ARM64 scope
Choose the generic UEFI installer, the Pi 4B-only U-Boot appliance, or the Pi 5 D0-only third-party UEFI appliance. Pi 400, CM4, CM5, Pi 500, C1 boards and Pi 5 onboard networking are out of scope.
Download center
Your firewall starts with a verifiable build.
Choose the supported Stable line or an experimental Development build, verify one checksum, and install on amd64 or ARM64 UEFI hardware, a virtual machine or a cloud disk. Every published image is tied to exact source, ports, OS-definition and FreeBSD revisions. Already on 1.0? Upgrade in place instead of reinstalling.
Reading the release documents…
This picker stores no release versions. It reads the independently publishedStable and Development documents live from the package service; image links point to immutable files on the download service.
Installation
From image to gateway.
Use a dedicated appliance or VM with at least two interfaces, or one VLAN-capable interface.
64-bit CPU4 GB RAM16 GB storage2 network interfaces
Verify the download
Compare the file with the SHA-256 checksum shown above, from the same release document.
sha256sum FreeSense-*Write the installer
Write the amd64 ISO to a USB stick or attach it to a VM. Decompress an ARM64 installer IMG first, then write it to a 4 GB or larger device.
xz -dk FreeSense-*-arm64-installer.img.xzBoot and configure
Assign WAN and LAN, open the WebUI, then replace the initial administrator password.
First-boot guide →
Raspberry Pi preview
Appliance images are published on the Development line only and remain experimental and unsupported. Pi 5 needs EEPROM firmware dated 2025-06-09 or newer and supported USB Ethernet adapters. Flashing guide.
Cloud networking
Use two NICs so management stays on LAN. A one-NIC image permits key-only WAN SSH only when metadata supplies a valid key; restrict it with a security group. The WebUI is never opened on WAN automatically.
Independent build flow
Rebuild only what changed.
System updates and optional packages have separate fingerprints, repositories and publication decisions.
1
Check the System
A daily planner builds and publishes the System only when its sealed inputs change.
2
Reuse packages
Optional packages are reused while their sources and the FreeBSD pin are unchanged.
3
Verify images
The ISO and every UFS/ZFS cloud image pass integrity and boot-smoke checks.
4
Publish
Immutable files go public before the channel document advances.