> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# pfSense / OPNsense

> Forward firewall and DHCP syslog from pfSense and OPNsense

## Set up

Follow the shared [Log Forwarders](https://docs.wirespeed.co/integrations/log-forwarders.md) guide to add **pfSense / OPNsense** and open **Forwarder Details** (or ask Chat for the listener `ip:port`).

### pfSense

1. Open **Status** > **System Logs** and select the **Settings** tab
2. Under **General Logging Options**, set **Log Message Format** to **syslog (RFC 5424, with RFC 3339 microsecond-precision timestamps)**. Its timestamps carry the UTC offset and it includes the firewall's hostname. **BSD (RFC 3164, default)** is also supported, but it carries no hostname and its timestamps have no time zone, so they are read as UTC. This setting also changes the format of the firewall's local logs
3. Under **Remote Logging Options**, check **Enable Remote Logging**
4. Enter the listener as `ip:port` in **Server 1** under **Remote log servers**. pfSense sends only over UDP, so use a UDP listener. UDP syslog is unencrypted and unauthenticated, so send it only over a trusted network or VPN tunnel. If it must leave through a VPN, set **Source Address** to that interface
5. Under **Remote Syslog Contents**, select **Everything**. If you'd rather limit it, select at least **Firewall Events**, **DHCP Events**, and **DNS Events**
6. Click **Save**. Events will begin showing up shortly

DHCP lease details are parsed from the Kea DHCP server, which is selected under **System** > **Advanced** > **Networking** > **Server Backend**. Lines from the deprecated ISC DHCP backend are kept under **Other**.

### OPNsense

1. Open **System** > **Settings** > **Logging** and select the **Remote** tab
2. Click **+** to add a destination and check **Enabled**
3. Set **Transport** to match **Forwarder Details** (**UDP(4)**, **TCP(4)**, or **TLS(4)**, or the **(6)** variant for an IPv6 listener), and enter the listener's **Hostname** and **Port**
4. Leave **Applications** empty to send everything, or select at least **filter (filterlog)** and your DHCP server: **kea (kea-dhcp4)**, **dhcpd (dhcpd)**, or **dnsmasq (dnsmasq)**
5. Check **RFC5424**, click **Save**, then click **Apply**

If **Forwarder Details** shows **TLS: Enabled**, OPNsense needs two things before it can connect. First, import the CA that issued Wirespeed's certificate under **System** > **Trust** > **Authorities**. Second, select a client certificate in the destination's **Certificate** field. OPNsense won't save a TLS destination without one; any certificate with a private key from **System** > **Trust** > **Certificates** works. See [Syslog over TLS](https://docs.wirespeed.co/integrations/log-forwarders.md#syslog-over-tls).

## Parsed events

Each line is tagged with its program family (`filterlog`, `kea_dhcp`, `filterdns`, `cron`, or `other`). pfSense's default BSD (RFC 3164) format carries no hostname, so the **host** field is empty unless you switch **Log Message Format** to syslog (RFC 5424).

* **Firewall** (`filterlog`): rule number, sub-rule, anchor, tracker, interface, reason, action, and direction, plus the IPv4 or IPv6 header (TTL or hop limit, flags, protocol, length, source and destination IPs). TCP and UDP add ports and data length; TCP adds flags, sequence, acknowledgment, window, and options. ICMP adds the type and its per-type fields, and CARP adds its advertisement fields. OPNsense is detected from its 32-character rule label and recorded as the variant.
* **DHCP** (`kea_dhcp`): Kea log level, logger, and message ID. Lease messages such as `DHCP4_LEASE_ALLOC` add the client MAC, client ID, transaction ID, leased IP, and lease duration.
* **Filter DNS** (`filterdns`): the alias hostname being resolved, recorded as a domain. On pfSense this requires **DNS Events** or **Everything**.
* **Cron** (`cron`): the user and command.
* **Other**: lines from other programs are kept with their program name and message. webConfigurator (nginx) access lines also include the client IP, request, status, and user agent.

Sign-ins to the web interface and SSH are not yet normalized.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.