How to get traffic + Geo location report

[xpking]

Dear all,

I am new to OPNsense.
I would like to have source IP, source port, dest resolved hostname, dest port, Geo location, time.
Is there any function or plugin in OPNsense can provide such report?
I tried Netflow and ntopng seems not able to do. Or maybe I don't know how to setup?

Please advise. Thank you.

Regards,
SK

[cookiemonster]

Not an available "report" from OPN. You'll need to coble it together.

[xpking]

Thank you for your reply.
If I only need source IP, source port, dest resolved hostname, dest port, time, (no need Geo location), then I should be able to generate from OPNsense as this is a firewall?

[cookiemonster]

Yes to a point, for clarity:
- source ip, source port, dest ip, dest port, time. This is indeed firewall bread and butter and is logged to log files according to user's logging preferred settings.
- dest hostname requires name resolution for external, hostnames records if internal. Translations are not logged.
- There is no "reporting" available out of the box that will output those as a preformatted output on a specified schedule. The log file values are what you would see in the firewall log but yes, that data is logged to file.

[xpking]

Thank you.
If I just need like keeping past 90 days records to review, what is the best option?
I think firewall log don't have many filters and difficult to read.

[cookiemonster]

System > Settings > Logging. There in "Preserve logs (Days)" you can override the 30 days default.
Watch for disk usage, ensure you have enough space.
There you can also send the logs to a log server if you wanted/have one setup. Offloading the data.
You might also want to check out ntop-ng. OPN has a plugin for it.

[CJ]

I believe there are some dashboards you can find online, probably built with something like grafana, that you can use with an external logging server in order to provide the capability you want with a nice view.

I forget where I saw them as I haven't had a chance to set one up myself yet.

[cookiemonster]

Only grafana dashboards I've seen are for pf counters and stats but I'd like to see if you can remember what you saw.

[CJ]

Only grafana dashboards I've seen are for pf counters and stats but I'd like to see if you can remember what you saw.

I think this is it. https://github.com/bsmithio/OPNsense-Dashboard

I make no claims to its quality as I've done nothing but look at the picture.  But one of the panels shows a geo representation of blocked events.

[cookiemonster]

nice, thanks.