Integrating pfSense with LogCentral
pfSense, a powerful open-source firewall and router platform, includes built-in logging features.
By default, pfSense stores logs locally.
For better monitoring, compliance, and centralized management, you can forward logs to a remote syslog server such as LogCentral.
Why send your pfSense logs to LogCentral?
Centralized monitoring: correlate logs from multiple sites and devices in one place.
Compliance: store logs securely in the EU and meet regulatory requirements.
Resilience: logs remain available even if your pfSense device fails.
Advanced analysis: leverage LogCentral’s dashboards or connect with SIEM tools.
Step-by-Step Configuration
Step 1: Create your location in LogCentral
Inside your organization, create a new location for the site where your pfSense firewall is deployed.
Add the public IP address of your pfSense device to the list of authorized IPs.
Set the location status to Active.
LogCentral provides you with a dedicated IPv4/IPv6 address and a port. These are the values you’ll use in pfSense.
Step 2: Access the pfSense Web Interface
Log in to pfSense with your admin credentials.
Navigate to Status > System Logs to confirm that local logging is working.
Step 3: Configure Remote Logging to LogCentral
Go to Status > System Logs > Settings.
In the Remote Logging Options section:
Enable Remote Logging: check this box.
Remote Log Servers: enter the IP address and port provided by LogCentral (e.g.
203.0.113.45:5514).Remote Syslog Contents: select the log categories you want to forward (Firewall, DHCP, VPN…). Choose only what’s necessary to reduce noise.
Remote Syslog Protocol: choose UDP (default, lightweight) or TCP (more reliable).
Click Save.
Step 4: Verify Logs in LogCentral
In LogCentral, open the location you created and check if events are arriving.
Generate logs in pfSense (for example, access a blocked site or restart a service).
Confirm that the events appear in LogCentral with our live log visualization feature.
Step 5: Fine-Tune the Setup
Log selection: forward only necessary categories to control volume and costs.
Performance: avoid overloading pfSense or your network by reducing unnecessary verbosity.
Retention policies: LogCentral stores logs for 1 year by default
Troubleshooting
Connectivity: test from pfSense with
pingortelnetto the LogCentral IP and port.Firewall rules: ensure outbound traffic to LogCentral is not blocked.
Error logs: check Status > System Logs > General in pfSense if logs aren’t forwarding.
Conclusion
By forwarding logs from pfSense to LogCentral, you gain centralized, secure, and compliant log management.
Each location in LogCentral corresponds to one of your sites, with its own authorized IPs and dedicated port.
This makes it simple to stay compliant, monitor your network in real-time, and keep a reliable audit trail without overloading your firewall hardware.