pfSense allows you to backup (export) and/or restore a configuration for a specific service or for the entire pfSense machine.
Which can be very useful before making certain changes to your pfSense machine or to be able to easily restore its configuration in the event of a pfSense failure.

1. Save (export) pfSense configuration
2. Restore pfSense configuration
3. Restore manually installed packages

1. Save (export) pfSense configuration

To save (export) the pfSense configuration, go to the menu: Diagnostics -> Backup & Restore.

On the "Backup & Restore" page that appears, in the "Backup Configuration" section, you can choose:

• Backup area: the specific service for which you must backup (export) the configuration or by default the complete configuration (All) of your pfSense machine.
  In the list, you will find in particular the DHCP servers (v4/v6), the firewall rules, the configuration of the interfaces, the SNMP server, ... from pfSense.
• Skip packages: by default, the configuration of packages installed by the user on pfSense is also saved.
  To back up only the pfSense configuration, ignoring the configuration of subsequently installed packages, check the "Do not backup package information" box.
• Skip RRD data: by default, the "Do not backup RRD data..." box is checked to NOT save RRD (Round-Robin Database) data. This data is only useful if you want to be able to restore the graphs used for pfSense monitoring.
  However, this box is checked by default because RRD data can be very large.
• Include extra data: allows you to also save optional additional data for certain services.
  Such as: the DHCP lease database and that of the captive portal (if applicable).
  To do this, check the "Backup extra data" box.
  Again, this may increase the size of the backup that will be created.
• Backup SSH keys: allows you to backup the SSH keys of the pfSense machine. This will prevent users connecting by SSH to your pfSense machine from receiving a warning about the fingerprint that has changed.
  To do this, check the box "Backup SSH keys (otherwise clients would fail to recognize the host keys after restore)".
• Encryption: by default, the configuration will be exported in clear XML format.
  However, you can encrypt the backup using a password by first checking the "Encrypt this configuration file" box.

Next, click "Download configuration as XML" to save (export) the configuration of your pfSense machine.

Source : Making Backups in the GUI | pfSense Documentation.

If you open the exported file with notepad, you will see that it is a simple XML file.

If you check the "Encrypt this configuration file" box, a "Password" section will appear with 2 boxes where you simply specify the password to use to encrypt the configuration that will be exported.

This is what an encrypted pfSense configuration file looks like.

2. Restore pfSense configuration

In the "Restore Backup" section of the same page, you can specify:

• Restore area: the service for which the configuration must be restored or by default the complete configuration (All) of the pfSense machine.
• Configuration file: the pfSense configuration file exported previously.
• Encryption: check the "Configuration file is encrypted" box if the content of the configuration file used is encrypted.

Next, click "Restore Configuration".

Warning : as specified below the button, pfSense will restart automatically after restoring the configuration.

If you have checked the "Configuration file is encrypted" box, a "Password" field will appear where you can specify the password used to encrypt the contents of the previously exported configuration file.

Confirm the restoration of the pfSense configuration by clicking OK.

Plain Text

Are you sure you wish to restore configuration?

A warning will appear at the top of the page during the reboot.

Plain Text

The firewall configuration has been changed.
The firewall is now rebooting.

Once your pfSense machine has restarted, you will have access to its web interface again.
However, you will have to log in again.

At the top right, you will see that a notification is available.
Click on the little red bell.

You will see this message appear.

Plain Text

Package reinstall process finished successfully.

Click: Mark All as Read.

3. Restore manually installed packages

If you backed up your pfSense machine configuration and reinstalled it, you may notice that the packages you installed manually will not have been automatically restored.
To reinstall them easily, simply click on the "Reinstall Packages" button in the "Package Functions" section available at the bottom of the page.

Reinstallation of all manually installed packages previously referenced by the restored configuration file above will begin.
This will save you from having to find and reinstall them manually one by one.

Source : How Backup whole pfsense with packages | Netgate Forum.