Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Notification when a connection is established

    Scheduled Pinned Locked Moved General pfSense Questions
    25 Posts 7 Posters 2.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mikeisfly
      last edited by

      Is it possible to setup a notification that a TCP connection has been established? If so please explain which package I would use or point me in the right direction.

      Example:

      I setup a port forward to access a camera from the outside of my network to the inside. When a connection is made, I would like the firewall to email me to let me know a connection has been established from X.X.X.X (remote client's public IP) going to Y.Y.Y.Y (My camera's private IP)

      Thanks in advance.

      NollipfSenseN 1 Reply Last reply Reply Quote 0
      • NollipfSenseN
        NollipfSense @mikeisfly
        last edited by

        @mikeisfly Using a VPN to connect to your camera would give you instant notification that you're connected...

        pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
        pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

        M 1 Reply Last reply Reply Quote 0
        • M
          mikeisfly @NollipfSense
          last edited by

          @NollipfSense I'm not trying to connect to the camera remotely I want to be notified when someone else connects to the camera remotely and I don't want to have to log into the firewall and keep refreshing the state table to see if that's done.

          NollipfSenseN 1 Reply Last reply Reply Quote 0
          • NollipfSenseN
            NollipfSense @mikeisfly
            last edited by

            @mikeisfly That's why you use VPN. Is this your personal camera? Do you give out access to this camera to others?

            pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
            pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

            M 1 Reply Last reply Reply Quote 0
            • M
              mikeisfly @NollipfSense
              last edited by

              @NollipfSense I know what the purpose of a VPN is. I'm working with a engineer to see if I can get greater compatibility between their software and my cameras. What I'm looking for specifically is the feature I'm asking about. It may not be possible but I think it could be a good diagnostic/information tool. I could look at the logs of the camera, I could refresh the state table of the firewall but this isn't what I'm asking for. I don't want to pull the information I want a notification pushed to me when a event happens (TCP connection to my camera). I can access the camera fine from outside my network.

              NollipfSenseN 1 Reply Last reply Reply Quote 0
              • NollipfSenseN
                NollipfSense @mikeisfly
                last edited by NollipfSense

                @mikeisfly I am sure you should be able to accomplish the task with a script. You could search if there is such a script or one that you modify to your use. You could also consider may be posting a bounty

                pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan
                  last edited by

                  @mikeisfly : VPN is/was mentioned, because normally, devices like cameras are not accessible 'by the public' from the outside.

                  I'm using myself a dedicated VPN access set on my home devices and Phone so I can access the companies network, which enables my to launch the app that let's me see all the connected cameras.

                  By local law (France), I am allowed to use 'snapshots' on our web site (although the first camera is showing our clients up-close ... oops).

                  With a simple scripts I do receive mails when some one is using a camera VPN access.

                  I know, really public web cams exist. But imagine : these can be hit by really a lot of IP's (hit by a robot ?) : be ready to send out huge number of mails ...

                  A solution might be : use a firewall (NAT) pass rule and have it log.
                  Set up the logging to an external syslog server, and have something like fail2ban to analyse it. fail2ban could ban (not needed here) and also send a mail when a rule hits the criteria (visiting the IP of the camera).

                  pfSense, by itself : you'll be in for some basic shell (bash or Python) scripting.

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  JKnottJ 1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott @Gertjan
                    last edited by

                    @Gertjan said in Notification when a connection is established:

                    I know, really public web cams exist. But imagine : these can be hit by really a lot of IP's (hit by a robot ?)

                    Security cameras are not just put on a network by themselves. There is a recorder, which the cameras connect to. Those cameras should be on their own network, with only the recorder reachable from elsewhere. Many recorders will have 2 network connections for that reason.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @JKnott
                      last edited by

                      @JKnott said in Notification when a connection is established:

                      There is a recorder, which the cameras connect to

                      That's what I use : a stack of big boxes ( [these](https://www.dahuasecurity.com/products/productDetail/28297 - sorry for the publicity) ) with all the cameras and screens connected to it.
                      But a typical SOHO camera these days has a Wifi interface, and are used as a local LAN autonomous device.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 0
                      • NollipfSenseN
                        NollipfSense
                        last edited by

                        I have four Hikvision cameras on my network; so, I was looking at them to see whether the camera could notify...the events doesn't cover network access...only what the camera sees. Also, any robust firewall setup would not include access to LAN without the LAN device initiates the contact.

                        pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                        pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          mikeisfly @NollipfSense
                          last edited by

                          @NollipfSense what about a port forward. If you set that up then the camera will accept connection from the outside provided you have a strong username and password at the end device. Again I'm just looking for a particular functionality pfSense.

                          NollipfSenseN bmeeksB 2 Replies Last reply Reply Quote 0
                          • NollipfSenseN
                            NollipfSense @mikeisfly
                            last edited by

                            @mikeisfly Port forward would work if your intent is to give a few accesses to the camera...you might able to may be use Radius and script to email you when that happens. If the intent is to see whether anyone access the camera from the outside well a robust firewall would not allow that.

                            pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                            pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                            1 Reply Last reply Reply Quote 0
                            • bmeeksB
                              bmeeks @mikeisfly
                              last edited by bmeeks

                              @mikeisfly said in Notification when a connection is established:

                              Again I'm just looking for a particular functionality pfSense.

                              There is no such built-in functionality within pfSense (nor any other firewall that I am aware of). The way to do this is to send all logs to an external server or SIEM and then parse the logs there and fire alerts on specific traffic from tools on that external server.

                              There are many options in the external logging and SIEM world from free to $100,000 USD and more.

                              M Raffi_R 2 Replies Last reply Reply Quote 1
                              • M
                                mikeisfly @bmeeks
                                last edited by

                                @bmeeks said in Notification when a connection is established:

                                @mikeisfly said in Notification when a connection is established:

                                Again I'm just looking for a particular functionality pfSense.

                                There is no such built-in functionality within pfSense (nor any other firewall that I am aware of). The way to do this is to send all logs to an external server or SIEM and then parse the logs there and fire alerts on specific traffic from tools on that external server.

                                There are many options in the external logging and SIEM world from free to $100,000 USD and more.

                                Thank you. Maybe this is something the development team may want to look at to make the product stand out even more. Not sure who is looking for the feature but it occurred to me a few weeks ago, that it would be nice to have.

                                NollipfSenseN 1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  So like an alert-on-match option maybe?

                                  This is the first time I've seen it requested so there may not be much drive but I could see that being useful.

                                  Steve

                                  M 1 Reply Last reply Reply Quote 1
                                  • M
                                    mikeisfly @stephenw10
                                    last edited by

                                    @stephenw10 said in Notification when a connection is established:

                                    So like an alert-on-match option maybe?

                                    This is the first time I've seen it requested so there may not be much drive but I could see that being useful.

                                    Steve

                                    Yes, that would be awesome.

                                    1 Reply Last reply Reply Quote 0
                                    • Raffi_R
                                      Raffi_ @bmeeks
                                      last edited by

                                      @bmeeks said in Notification when a connection is established:

                                      @mikeisfly said in Notification when a connection is established:

                                      Again I'm just looking for a particular functionality pfSense.

                                      There is no such built-in functionality within pfSense (nor any other firewall that I am aware of). The way to do this is to send all logs to an external server or SIEM and then parse the logs there and fire alerts on specific traffic from tools on that external server.

                                      There are many options in the external logging and SIEM world from free to $100,000 USD and more.

                                      +1 on what Bill said. I can personally recommend an ELK setup which you can send the pfSense logs to. I believe you can then setup alerts on a particular event. ELK is free and can be easily setup on Linux since it's very well documented (even I was able to do it). I've never used ELK for alerting, but I might eventually. Right now it's only for super fast log searches and nice visuals to quickly see things.

                                      M 1 Reply Last reply Reply Quote 0
                                      • NollipfSenseN
                                        NollipfSense @mikeisfly
                                        last edited by

                                        @mikeisfly said in Notification when a connection is established:

                                        Maybe this is something the development team may want to look at to make the product stand out even more.

                                        I can see this been useful on the camera as part of the camera's event monitoring...just not on a firewall. The day I get that notification is the day the firewall goes in the trash bin. I even block my cameras from going out to check for firmware update.

                                        pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                                        pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                                        M 1 Reply Last reply Reply Quote 0
                                        • M
                                          mikeisfly @NollipfSense
                                          last edited by

                                          @NollipfSense said in Notification when a connection is established:

                                          @mikeisfly said in Notification when a connection is established:

                                          Maybe this is something the development team may want to look at to make the product stand out even more.

                                          I can see this been useful on the camera as part of the camera's event monitoring...just not on a firewall. The day I get that notification is the day the firewall goes in the trash bin. I even block my cameras from going out to check for firmware update.

                                          Not sure why getting a notification about a event that happened from a connection you explicitly allowed would be a bad thing? I'm looking for this functionality as more of a tracking tool. Like with any service the development team might implement you don't have to use it.

                                          NollipfSenseN bmeeksB 2 Replies Last reply Reply Quote 0
                                          • M
                                            mikeisfly @Raffi_
                                            last edited by

                                            @Raffi_ said in Notification when a connection is established:

                                            @bmeeks said in Notification when a connection is established:

                                            @mikeisfly said in Notification when a connection is established:

                                            Again I'm just looking for a particular functionality pfSense.

                                            There is no such built-in functionality within pfSense (nor any other firewall that I am aware of). The way to do this is to send all logs to an external server or SIEM and then parse the logs there and fire alerts on specific traffic from tools on that external server.

                                            There are many options in the external logging and SIEM world from free to $100,000 USD and more.

                                            +1 on what Bill said. I can personally recommend an ELK setup which you can send the pfSense logs to. I believe you can then setup alerts on a particular event. ELK is free and can be easily setup on Linux since it's very well documented (even I was able to do it). I've never used ELK for alerting, but I might eventually. Right now it's only for super fast log searches and nice visuals to quickly see things.

                                            Thanks for the suggestion.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.