"
Hi all,
Some of you have used bsmithio/OPNsense-Dashboard, the Grafana dashboards for OPNsense fed by Telegraf, InfluxDB and Graylog. It hasn't been updated since October 2023, and newer OPNsense releases broke parts of it: the gateway script's get_interfaces_info() error, empty dashboards, and the Suricata hook that 26.1 removed.
I've picked it up and maintain it here:
github.com/tekgnosis-net/OPNsense-Dashboard
Credit goes to bsmithio and to Victor Robellini's pfSense-Dashboard, which it grew from. The history is in the NOTICE file.
What it shows
What changed for current OPNsense
Monitoring host
A single docker compose stack, configured from one .env file: Grafana 13.2, InfluxDB 2.9, Graylog 7.1 with OpenSearch 2.19, and MongoDB 7.0. A one-shot graylog-init sets up Graylog (syslog input, extractors, stream, index set, GeoIP). If you only want metrics, a metrics-only mode runs just InfluxDB and Grafana.
Getting started
The repository has unit tests for the firewall scripts and an end-to-end test that brings up the whole stack with synthetic data and checks every dashboard query. I run it on my own firewall.
Feedback is welcome, especially from multi-WAN, IPv6 and HA setups. Bugs and feature requests go to GitHub issues, questions to Discussions, or reply here.
The attached screenshots show synthetic test data.
Some of you have used bsmithio/OPNsense-Dashboard, the Grafana dashboards for OPNsense fed by Telegraf, InfluxDB and Graylog. It hasn't been updated since October 2023, and newer OPNsense releases broke parts of it: the gateway script's get_interfaces_info() error, empty dashboards, and the Suricata hook that 26.1 removed.
I've picked it up and maintain it here:
github.com/tekgnosis-net/OPNsense-Dashboard
Credit goes to bsmithio and to Victor Robellini's pfSense-Dashboard, which it grew from. The history is in the NOTICE file.
What it shows
- System: CPU, load, RAM, disk, temperatures, uptime and pf statistics
- Gateways: RTT, loss and status from dpinger
- Interfaces: addresses, status, and WAN/LAN traffic and throughput, labelled with your OPNsense interface names
- Firewall log through Graylog: blocked events, ports, protocols and a GeoIP map. The top blocked flows are split into "from the internet" and "from your own networks", and each row shows whether it was a new connection or a late packet of a closed connection. Click a source to filter the whole row to it.
- Suricata alerts on a separate dashboard
What changed for current OPNsense
- Written for OPNsense 26.7, against the 26.7.4 source. The interface and gateway collector is rewritten for the current API.
- No sudoers edits any more. os-telegraf's "Run as Root" option covers what needs root: pf statistics, dpinger status and Suricata's eve.json.
- Suricata alerts come from os-telegraf's built-in Intrusion Detection Alerts input.
- The Graylog extractors follow the current filterlog format, including IPv6 and ICMPv6.
Monitoring host
A single docker compose stack, configured from one .env file: Grafana 13.2, InfluxDB 2.9, Graylog 7.1 with OpenSearch 2.19, and MongoDB 7.0. A one-shot graylog-init sets up Graylog (syslog input, extractors, stream, index set, GeoIP). If you only want metrics, a metrics-only mode runs just InfluxDB and Grafana.
Getting started
- Monitoring host: docs/stack.md
- Firewall: docs/opnsense.md covers the os-telegraf plugin, the two collector scripts and remote syslog. An Ansible playbook installs the collectors.
- Coming from the bsmithio version: the monitoring stack needs a fresh install. The playbook removes the old sudoers lines and Suricata files from the firewall.
The repository has unit tests for the firewall scripts and an end-to-end test that brings up the whole stack with synthetic data and checks every dashboard query. I run it on my own firewall.
Feedback is welcome, especially from multi-WAN, IPv6 and HA setups. Bugs and feature requests go to GitHub issues, questions to Discussions, or reply here.
The attached screenshots show synthetic test data.
