Hi all,
Some of you have used bsmithio/OPNsense-Dashboard (https://github.com/bsmithio/OPNsense-Dashboard), the Grafana dashboards for OPNsense fed by Telegraf, InfluxDB and Graylog. It hasn't been updated since October 2023, and newer OPNsense releases broke parts of it: the gateway script's get_interfaces_info() error, empty dashboards, and the Suricata hook that 26.1 removed.
I've picked it up and maintain it here:
github.com/tekgnosis-net/OPNsense-Dashboard (https://github.com/tekgnosis-net/OPNsense-Dashboard)Credit goes to bsmithio and to Victor Robellini's pfSense-Dashboard (https://github.com/VictorRobellini/pfSense-Dashboard), which it grew from. The history is in the NOTICE (https://github.com/tekgnosis-net/OPNsense-Dashboard/blob/master/NOTICE) file.
What it shows- System: CPU, load, RAM, disk, temperatures, uptime and pf statistics
- Gateways: RTT, loss and status from dpinger
- Interfaces: addresses, status, and WAN/LAN traffic and throughput, labelled with your OPNsense interface names
- Firewall log through Graylog: blocked events, ports, protocols and a GeoIP map. The top blocked flows are split into "from the internet" and "from your own networks", and each row shows whether it was a new connection or a late packet of a closed connection. Click a source to filter the whole row to it.
- Suricata alerts on a separate dashboard
What changed for current OPNsense- Written for OPNsense 26.7, against the 26.7.4 source. The interface and gateway collector is rewritten for the current API.
- No sudoers edits any more. os-telegraf's "Run as Root" option covers what needs root: pf statistics, dpinger status and Suricata's eve.json.
- Suricata alerts come from os-telegraf's built-in Intrusion Detection Alerts input.
- The Graylog extractors follow the current filterlog format, including IPv6 and ICMPv6.
Monitoring hostA single docker compose stack, configured from one .env file: Grafana 13.2, InfluxDB 2.9, Graylog 7.1 with OpenSearch 2.19, and MongoDB 7.0. A one-shot graylog-init sets up Graylog (syslog input, extractors, stream, index set, GeoIP). If you only want metrics, a metrics-only mode runs just InfluxDB and Grafana.
Getting started- Monitoring host: docs/stack.md (https://github.com/tekgnosis-net/OPNsense-Dashboard/blob/master/docs/stack.md)
- Firewall: docs/opnsense.md (https://github.com/tekgnosis-net/OPNsense-Dashboard/blob/master/docs/opnsense.md) covers the os-telegraf plugin, the two collector scripts and remote syslog. An Ansible playbook installs the collectors.
- Coming from the bsmithio version: the monitoring stack needs a fresh install. The playbook removes the old sudoers lines and Suricata files from the firewall.
The repository has unit tests for the firewall scripts and an end-to-end test that brings up the whole stack with synthetic data and checks every dashboard query. I run it on my own firewall.
Feedback is welcome, especially from multi-WAN, IPv6 and HA setups. Bugs and feature requests go to GitHub issues (https://github.com/tekgnosis-net/OPNsense-Dashboard/issues/new/choose), questions to Discussions (https://github.com/tekgnosis-net/OPNsense-Dashboard/discussions/categories/q-a), or reply here.
The attached screenshots show synthetic test data.