pfSense and OPNsense: send syslog, NetFlow and SNMP traps to MobiObs

Before you start

The MobiObs device is 10.20.4.9 in the examples; use the address on its Network screen. Android does not let apps listen on ports below 1024, and MobiObs uses the same ports on every platform, so use these destinations:

Put the MobiObs device on a LAN or management interface of the firewall. If it is on a different interface from the one the firewall sends from, check that the firewall rules allow the traffic; traffic the firewall itself originates is normally allowed out.

pfSense remote syslog

1. Go to Status > System Logs and open the Settings tab.
2. Under Remote Logging Options, tick Send log messages to remote syslog server.
3. Set Source Address to the interface that faces the MobiObs device (or leave it on Any), and IP Protocol to IPv4.
4. In the first Remote log servers field, enter 10.20.4.9:5514. Without a port, pfSense uses 514.
5. Under Remote Syslog Contents, tick Everything, or only the categories you need, such as Firewall Events, DHCP Events or VPN Events, and click Save.

The built-in syslog daemon sends over UDP only; Netgate suggests the syslog-ng package for TCP. Log Message Format in the general settings on the same tab switches between BSD (RFC 3164, the default) and syslog (RFC 5424); MobiObs reads both. Firewall Events are only as useful as the rules that log: rules with logging enabled, and the default deny rule, produce them.

pfSense NetFlow

1. Install the softflowd package from System > Package Manager, on the Available Packages tab.
2. Go to Services > softflowd and enable it.
3. Select the interfaces to watch, usually LAN (and WAN only if you also need traffic the firewall itself originates).
4. Set Host to 10.20.4.9 and Port to 2055. Leave the NetFlow version on 10 (IPFIX) or choose 9; MobiObs decodes both. Save.

On pfSense Plus 24.03 and later there is also a built-in exporter under Firewall > Packet Flow Data: set the destination IP address to 10.20.4.9, the destination port to 2055 and the flow protocol to IPFIX or NetFlow v5. It is not available on pfSense CE.

pfSense SNMP traps

Go to Services > SNMP. In the SNMP Traps section, enable traps, set Trap server to 10.20.4.9, Trap server port to 1162 (the default is 162), and SNMP trap string to the community you enter in MobiObs. Save. The SNMP service must be enabled for traps to be generated.

OPNsense remote syslog

1. Go to System > Settings > Logging and open the Remote tab.
2. Add a destination. Tick Enabled and choose Transport UDP(4), or TCP(4) for bursts.
3. Leave Applications empty to send all of them, or choose a few such as the firewall filter, DHCP or OpenVPN. Pick the Levels to send.
4. Set Hostname to 10.20.4.9 and Port to 5514. Tick RFC5424 if you want structured timestamps; MobiObs reads either format. Add a description, save and apply.

OPNsense NetFlow

1. Go to Reporting > NetFlow.
2. Under Listening interfaces, select the interfaces to export from, for example LAN and WAN.
3. Add the WAN to WAN interfaces as well, so it is captured on egress only. With NAT, this avoids counting the same traffic twice.
4. Set Version to v9, add 10.20.4.9:2055 under Destinations, and apply.

OPNsense also uses the same export for its own Insight reports; adding a destination does not affect them. OPNsense does not export IPFIX. Its Net-SNMP plugin configures the SNMP agent only and has no trap settings in the web interface, so traps are not covered here.

Verify it works

• Logs. Messages appear with the firewall’s hostname and apps such as filterlog, dhcpd or openvpn. Filter Logs by app to separate firewall decisions from the rest. To create a message on demand, change and save any setting, or connect a client to trigger DHCP.
• Flows. Within a minute or two, Flows shows bytes over time and the top talkers, destinations and ports. If flows arrive but the screen stays empty, wait for the next template.
• Traps (pfSense). Restarting the SNMP service sends a coldStart trap, which appears on the SNMP Traps screen.
• Sources. Lists the firewall with the kinds of data received and the last-seen time.

Troubleshooting

• Nothing arrives. Use Diagnostics > Packet Capture on the interface towards the MobiObs device, filtered to port 5514, to see whether the firewall sends at all.
• pfSense is still sending to 514. The port must be in the server field itself, as 10.20.4.9:5514.
• Only some messages arrive. Check the Remote Syslog Contents categories (pfSense) or the Applications and Levels filters (OPNsense).
• Flows double up. On OPNsense, check that the WAN is listed under WAN interfaces; on pfSense, watch only LAN in softflowd.
• Traps are flagged in MobiObs. The trap string and the community in MobiObs do not match.

Afterwards, untick remote logging or delete the remote destination, remove the NetFlow destination or disable softflowd, and turn traps off if they were off before.