OPNsense-Dashboard is maintained again: Grafana dashboards for OPNsense 26.7

[highwalker]

Hi all,

Some of you have used bsmithio/OPNsense-Dashboard, the Grafana dashboards for OPNsense fed by Telegraf, InfluxDB and Graylog. It hasn't been updated since October 2023, and newer OPNsense releases broke parts of it: the gateway script's get_interfaces_info() error, empty dashboards, and the Suricata hook that 26.1 removed.

I've picked it up and maintain it here:
github.com/tekgnosis-net/OPNsense-Dashboard

Credit goes to bsmithio and to Victor Robellini's pfSense-Dashboard, which it grew from. The history is in the NOTICE file.

What it shows

• System: CPU, load, RAM, disk, temperatures, uptime and pf statistics
• Gateways: RTT, loss and status from dpinger
• Interfaces: addresses, status, and WAN/LAN traffic and throughput, labelled with your OPNsense interface names
• Firewall log through Graylog: blocked events, ports, protocols and a GeoIP map. The top blocked flows are split into "from the internet" and "from your own networks", and each row shows whether it was a new connection or a late packet of a closed connection. Click a source to filter the whole row to it.
• Suricata alerts on a separate dashboard

What changed for current OPNsense

• Written for OPNsense 26.7, against the 26.7.4 source. The interface and gateway collector is rewritten for the current API.
• No sudoers edits any more. os-telegraf's "Run as Root" option covers what needs root: pf statistics, dpinger status and Suricata's eve.json.
• Suricata alerts come from os-telegraf's built-in Intrusion Detection Alerts input.
• The Graylog extractors follow the current filterlog format, including IPv6 and ICMPv6.

Monitoring host
A single docker compose stack, configured from one .env file: Grafana 13.2, InfluxDB 2.9, Graylog 7.1 with OpenSearch 2.19, and MongoDB 7.0. A one-shot graylog-init sets up Graylog (syslog input, extractors, stream, index set, GeoIP). If you only want metrics, a metrics-only mode runs just InfluxDB and Grafana.

Getting started

• Monitoring host: docs/stack.md
• Firewall: docs/opnsense.md covers the os-telegraf plugin, the two collector scripts and remote syslog. An Ansible playbook installs the collectors.
• Coming from the bsmithio version: the monitoring stack needs a fresh install. The playbook removes the old sudoers lines and Suricata files from the firewall.

The repository has unit tests for the firewall scripts and an end-to-end test that brings up the whole stack with synthetic data and checks every dashboard query. I run it on my own firewall.

Feedback is welcome, especially from multi-WAN, IPv6 and HA setups. Bugs and feature requests go to GitHub issues, questions to Discussions, or reply here.

The attached screenshots show synthetic test data.