Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense - logging makes no sense

    Scheduled Pinned Locked Moved General pfSense Questions
    17 Posts 6 Posters 2.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L Offline
      lutel
      last edited by

      Great, beautiful charts, but have you got any MEANINGFUL information - like which rule (name) blocked any traffic? Of course you can draw pretty charts with geoip, so what? This firewall is not ready for enterprise - at least for one who cares about monitoring and have lots of firewall to manage.

      1 Reply Last reply Reply Quote 0
      • D Offline
        doktornotor Banned
        last edited by

        Dude, run

        
        pfctl -vvsr | grep label
        
        

        grab the IDs and labels, import them to whatever enterprise nonsense since you cannot decipher what blocked what, and after you are finished, get lost. We already got your point that you cannot live without descriptions.

        1 Reply Last reply Reply Quote 0
        • KOMK Offline
          KOM
          last edited by

          This firewall is not ready for enterprise

          OK, so now that you have made this determination for yourself, this is the last we should expect to see of you?

          1 Reply Last reply Reply Quote 0
          • DerelictD Offline
            Derelict LAYER 8 Netgate
            last edited by

            It would be nice if the system maybe logged the rules that are loaded into the filter so the firewall generating them and the trackers could be matched up in a log aggregator.

            As it is it is not THAT hard to match up the rule that generated the log but you need to go to the firewall to do it. Far from impossible.

            Timestamp full_message pf_tracker
            2016-12-15 19:33:35.000 1419131430
            filterlog: 217,16777216,,1419131430,igb1,match,block,out,4,0x10,,128,62814,0,none,17,udp,328,198.51.100.226,172.16.141.114,68,67,308

            Shell Output - pfctl -vvsr | grep -a2 1419131430

            [ Evaluations: 41920820  Packets: 625      Bytes: 122335      States: 0    ]
              [ Inserted: pid 69284 State Creations: 0    ]
            @217(1419131430) block return out log quick on WANS inet from any to unroutablev4:9label "USER_RULE: Block egress to UNROUTABLE"
              [ Evaluations: 41251689  Packets: 225965    Bytes: 44854695    States: 0    ]
              [ Inserted: pid 69284 State Creations: 0    ]

            OP do you really think the best way to get your point across is to be so caustic?</unroutablev4:9>

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • L Offline
              lutel
              last edited by

              Yes you can lick your balls, but i don't know how is it going to make this firewall better or useable in the future. You can say it has perfect logging, but in fact it lacks most basic capabilities - like sending in log stream rule names, log on session start/end. Have you ever heard about Firemon? It supports ANY decent firewall, but obviously it can't support pfSense - just because it can't provide any basic information on rule changes. So policy monitoring is also non-existing in the pfCrap. Lick your balls and thing of how great pfCrap is - but in fact it is just toy. Look at Firemon, this is serious security auditing tool for firewalls, you probably never heard of it.

              1 Reply Last reply Reply Quote 0
              • D Offline
                doktornotor Banned
                last edited by

                As predicted, nothing useful comes out of similar threads. Please, don't waste any more of your precious seconds with pfSense, noone's forcing you to use it.

                1 Reply Last reply Reply Quote 0
                • L Offline
                  lutel
                  last edited by

                  @Derelict:

                  OP do you really think the best way to get your point across is to be so caustic?

                  Sorry for this i'm disappointed and annoyed that otherwise such a good firewall lacks so basic functionality, and no one can't event put it on some "wish list". I just would like devs to realize how much it is needed.

                  1 Reply Last reply Reply Quote 0
                  • D Offline
                    doktornotor Banned
                    last edited by

                    If your wishlist inclusion requests look like

                    @lutel:

                    Lick your balls and thing of how great pfCrap is - but in fact it is just toy.

                    then it's extremely surprising noone is willing to listen to your wishes.

                    ::) ::) ::)

                    1 Reply Last reply Reply Quote 0
                    • L Offline
                      lutel
                      last edited by

                      @doktornotor:

                      If your wishlist inclusion requests look like

                      @lutel:

                      Lick your balls and thing of how great pfCrap is - but in fact it is just toy.

                      then it's extremely surprising noone is willing to listen to your wishes.

                      ::) ::) ::)

                      Is there any place where i can praise the great pfSense firewall and tell that i just can't expect anything more from such a great and complete firewall?

                      1 Reply Last reply Reply Quote 0
                      • D Offline
                        doktornotor Banned
                        last edited by

                        Maybe if you asked "Is there any way I can get firewall rules hits logged with descriptions on a remote syslog server so that I can find the problems more easily", you'd perhaps get a reasonable debate and suggestions. Meanwhile, you've managed to piss everyone off, so good luck with your requests.

                        And of course, the absolutely top priority with firewalls is exporting non-unique, often non-descriptive user comments into remote syslog. That's #1 to consider when choosing a firewall solution.

                        1 Reply Last reply Reply Quote 0
                        • dennypageD Offline
                          dennypage
                          last edited by

                          @doktornotor:

                          And of course, the absolutely top priority with firewalls is exporting non-unique, often non-descriptive user comments into remote syslog. That's #1 to consider when choosing a firewall solution.

                          Missed you Dok. :)

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.