View active connections
-
I have a pfSense installation that's acting as a firewall, DNS, IDS/IPS and DHCP server. Behind it I have a web server that users can connect to. I've setup port forwarding so that when a user connects to http://WAN_IP:PORT1, it gets forwarded to http://LAN_IP:PORT2. Everything is working great.
My question is: is there a way to see who connected (their IP) and when on pfSense? I went through the logs but couldn't find anything.
-
There are a number of packages to show various connection statistics. If you're trying to view the information using only the default installation, then Menu; "Diagnostics"; "States" will show you the active translations. (You could put the LAN_IP in the filter field.) Additionally, Menu "Diagnostics"; "pfTop" will show you live connections in realtime.
Neither of those options will show an actual timestamp or much of any historical data at all. For that type of information you'll want to install a package. I like ntop personally, but again not much historical data there.
-
Hi Hell0s,
If you edit the rule that you created to allow the Web access, scroll to the bottom of the rule and you will see a checkbox for logging.
"Log packets that are handled by this rule
Hint: the firewall has limited local log space. Don't turn on logging for everything. If you want to do a lot of logging, consider using a remote syslog server (see the Diagnostics: System logs: Settings page)."