Remote syslog to multiple servers

jeffhammett · Dec 15, 2015, 1:28 AM

I have my pfSense setup to send Syslog to a remote server on the same LAN. The server receives the syslog and everything is working as expected.

I added a second remote server to the Syslog settings, this server is located across an IPSEC tunnel. The tunnel is up and functioning and has wide open firewall rules to allow all traffic. But the second syslog server is not receiving any syslog from the pfSense (verified with tcpdump)

When I do a packet capture on my pfSense limited to port 514 I see the syslog being sent to the remote server on the LAN, but nothing being sent to the second remote syslog server across the IPSEC tunnel.

I verified that the <syslog>portion of /cf/conf/config.xml contains entries for both IP addresses.

Any thoughts on what to check next to try to get the remote syslog to the second server?

edit: i think I found my answer https://doc.pfsense.org/index.php/Why_can't_I_query_SNMP,_use_syslog,_NTP,_or_other_services_initiated_by_the_firewall_itself_over_IPsec_VPN</syslog>