Firewall Change log

CyClore

Is there a file, or a way that will show what changes have been made to the firewall? Say for example I make a config change to NAT or portforwarding. Is there a file that shows that I made the change?

muswellhillbilly

Not specifically as far as I know, although you can take a backup of your config prior to any change and run a diff against the new config.

KOM

Each rule has a Rule Information section at the bottom of the rule that shows when it was created and updated, but not the actual details of each change.

CyClore

I am looking for something to send to a syslog. We have many of these in production and now auditors want all these logs coming to a central location. I can see vpn users logging in and out and what pfblocker is doing, but nothing for actual firewall changes. I am really going to have to switch to something else. I bought all the pfsense devices from this site! Really hoping there is an easy solution. I have about 10 of these in the field and need another but if they can't syslog the firewall rules / port forewarding changes my boss may force me to change…

KOM

Since you have all this purchased hardware, they probably come with support, Why not contact ESF directly and get an official response?

jimp

Diagnostics > Backup/Restore, Config History tab

There isn't currently a way to send that info over syslog, though.

You could probably hack a log entry into write_config() that would log the revision description when it happens.

Quick one-line patch you can apply with the System Patches package: http://files.atx.pfsense.org/jimp/patches/log_config_write.patch

Sample output on save:

Mar 18 13:13:46 	php-fpm[54677]: /firewall_rules_edit.php: write_config: admin@198.51.100.6: /firewall_rules_edit.php made unknown change

Then you can filter your logs on "write_config" for example and it would find the changes and who made them (but not usually specifics about the change).

There are probably better ways to pull that off, so it's not something I'd commit as-is, but it may be good enough for what you need.

ntqpublic

@jimp Any update now ? I would like to us this feature as Official