Skip to content

Sending logs from pfSense and OPNsense

This guide completes Sending logs to the panel for pfSense and OPNsense firewalls. The values to enter (address and port) are on the page of the device in the panel, already filled in: below they are written as <Address> and <port in clear>.

1. What the panel receives

The firewall sends all its logs. With the model pfSense / OPNsense the panel reads them and shows them in the Events section of the Analysis page and in the reports:

In the Events section Where it comes from
Firewall blocked The connections blocked by the rules, with source address, destination, port and interface
Traffic allowed The connections passed by the rules you turned logging on for
Sign ins succeeded and failed The sign ins to the web interface and over SSH, with user and address
Administration The changes to the configuration, with who made them and from where
Attacks detected The addresses reported and blocked by the protection against repeated sign-in attempts
VPN The IPsec tunnels established and those that failed

All the other logs (services, DHCP, system) can still be searched in the Logs tile.

The firewall sends in UDP to the port in clear: pfSense offers nothing else for remote logging.

2. Adding the firewall in the panel

  1. On the Devices page, Add a device.
  2. Category Router and firewall, model pfSense / OPNsense.
  3. Name of the device: a name for you, for example "Office firewall".
  4. Recognized by: IP address, with the fixed public address the firewall goes out to the Internet from. If the address changes, see chapter 6.
  5. Add and show the instructions.

The page of the device shows the steps below already filled in with your Address and your port.

3. pfSense

The settings are in Status › System Logs › Settings.

Use the address, not the name

In the remote server field write the Address (the IP address of the server, on the page of the device), not the server name: so the sending does not depend on the DNS of the firewall.

The steps

  1. General Logging Options › Log Message Format: choose syslog (RFC 5424, with RFC 3339 microsecond-precision timestamps). With this format every log carries its timezone.
  2. Keep Log packets matched from the default block rules in the ruleset ticked: these are the blocked connections.
  3. Remote Logging Options:
  4. tick Enable Remote Logging;
  5. Source Address: Default (any);
  6. IP Protocol: IPv4;
  7. Remote log servers: <Address>:<port in clear>, for example 203.0.113.5:18670.
  8. Remote Syslog Contents: tick Everything.
  9. Save.

Allowed connections (optional)

To see the allowed traffic in the panel too, turn logging on in the rules that matter: Firewall › Rules, edit the rule, Extra Options, tick Log packets that are handled by this rule, Save and Apply Changes.

Do it only on the rules that count (for example access from outside to a server, or the VPNs): a rule that passes all the web browsing of the office produces a great many logs.

IPsec tunnels

With IPsec tunnels, pfSense writes many service messages (key renewals, checks that the tunnel is alive): they can be most of the logs. If they fill the logs, lower their levels in VPN › IPsec › Advanced Settings › IPsec Logging Controls. The tunnels established and those that failed stay visible.

4. OPNsense

The settings are in System › Settings › Logging, Remote tab.

  1. The + button adds a destination.
  2. Fill in:
Field Value
Enabled Ticked
Transport UDP(4)
Applications Empty: all
Levels All except debug
Facilities Empty: all
Hostname <Address>
Port <port in clear>
RFC5424 Ticked
Description Esapanel
  1. Save, then Apply.

Choose the levels: if the Levels field stays empty, OPNsense also sends the debug messages, many and of no use for monitoring.

For blocked and allowed connections, tick Log in the rules that matter (Firewall › Rules), with the same criterion as pfSense: only the rules that count.

5. Checking that the logs arrive

  1. Create an event: for example a sign in to the web interface of the firewall with a wrong password, then the right one.
  2. On the page of the device, Last log shows the time of the log just arrived.
  3. In the Logs tile search the logs of the device: the failed sign in is there.
  4. After a few minutes the Analysis page shows the failed sign in in the Events section, among the failed Sign ins.

6. Common problems

Nothing arrives

  • Check the Quarantine: if the logs arrive from an address different from the one entered (for example a firewall with two Internet connections), they are there. Authorize the address lets them in.
  • Check that you wrote the Address and the port in clear of your subscription, not port 514.
  • A firewall upstream, or the outbound rules of the firewall itself, must let UDP pass towards <Address> on <port in clear>.

The firewall has an address that changes

Recognize the firewall by its Device name instead of its address. The name is the one the firewall writes in the logs: on pfSense and OPNsense it is the hostname and domain set in System › General Setup (pfSense) or System › Settings › General (OPNsense), for example pfSense.home.arpa. Give each firewall a name of its own, different from the factory one, before using it in the panel.

Too many logs

  • Remove logging from the rules that pass a lot of traffic.
  • On pfSense lower the IPsec levels (see IPsec tunnels); on OPNsense leave out the debug level.
  • Devices of the local network that announce themselves (for example on port 5353, mDNS) can make most of the blocked connections: if you do not need them, do not log the rules that block them.