pfSense Integration Guide

Overview#

pfSense cannot send IDS alerts to an HTTP endpoint. To connect it to NxtFireGuard you run a Threat Feed Aggregator next to it: pfSense's Suricata package writes its alerts as EVE JSON to syslog, pfSense forwards them by UDP, and the aggregator passes only the Suricata alerts on to NxtFireGuard.

What You'll Need#

• pfSense with the Suricata package installed
• A Linux host with Docker for the Threat Feed Aggregator (a small VM is enough: 2 vCPUs, 2 GB RAM)
• Threat Feed Aggregator v1.0.9 or newer (the version that adds the pfSense service)

Integration Architecture#

pfSense (Suricata → EVE JSON → syslog)
        ↓  Syslog UDP :1028
Threat Feed Aggregator (pfSense service, keeps Suricata alerts only)
        ↓  HTTPS
NxtFireGuard

pfSense sends the same selection of logs to every remote syslog server. That's fine here: the aggregator drops everything that isn't a Suricata EVE alert (kernel messages, the web GUI log, config changes).

Setup Instructions#

Step 1: Create the Threat Sensor#

1. In the NxtFireGuard Dashboard, go to Data Ingestion → Threat Sensors and click Create Threat Sensor
2. Name: anything descriptive, for example pfSense Office
3. Hostname: the IP address pfSense sends syslog from, as seen by the aggregator (usually pfSense's address in the aggregator's network, for example 10.0.10.1). Don't enter the pfSense hostname: the aggregator identifies the sender by its source IP.
4. Type: pfSense
5. Under Sharing, choose which signals the sensor reports:
   • Public IPs: signals about public IPs count toward that IP's global score, shared with the NxtFireGuard community
   • Private IPs: signals about private IPs count only toward that IP's score in your account

Step 2: Set Up a Threat Feed Aggregator#

1. Go to Data Ingestion → Feed Aggregators and click Create Aggregator
2. Turn on Enable Syslog and, under the syslog services, pfSense
3. Logstash can stay off
4. Finish the wizard and install the aggregator on your Docker host using the commands from the install dialog
5. Check that the syslog container listens on UDP 1028:

docker ps --filter name=nfg-syslog

The aggregator should show as Up in the dashboard within a minute.

If the aggregator already exists, open it, enable pfSense under the syslog services and save. The aggregator picks up the change on its own.

Step 3: Configure Suricata's EVE Output#

1. In pfSense, go to Services → Suricata → Interfaces and edit the interface you want to watch (usually WAN)
2. In the interface settings, turn Send Alerts to System Log off. It writes a second, plain-text copy of every alert, which NxtFireGuard can't use.
3. Under EVE Output Settings:

1. Save, then go back to Services → Suricata → Interfaces and stop and start Suricata on the interface. Saving alone doesn't reload the EVE settings.

Why everything except alerts is off: TLS, DNS, HTTP and flow records describe normal traffic, including your own. NxtFireGuard only accepts event_type: alert and rejects the rest, so they would only add load. Turning the payload off keeps packet contents on your firewall.

Pick rule categories under the interface's Categories tab as usual. Noisy rule sets such as ICMP ping rules create many low-value events. NxtFireGuard maps Suricata's severity (1 = high, 3 = low) to its own criticality, so pings arrive as Low.

Step 4: Configure Remote Logging#

1. Go to Status → System Logs → Settings
2. Under Remote Logging Options, enable Send log messages to remote syslog server
3. Configure:

1. Save

Suricata's EVE syslog output is part of System Events. If you also run an NxtFireGuard traffic sensor, add it as a second remote server (for example <sensor-ip>:514) and also select Firewall Events.

Step 5: Verify Data Flow#

1. Wait for Suricata to raise an alert, or trigger one with a test rule. Add a custom rule on the interface:

alert http any any -> any any (msg:"NFG pipeline test"; flow:established,to_client; http.response_body; content:"NeverSSL"; nocase; sid:9000001; rev:1;)

then run curl http://neverssl.com/ from a host behind the firewall. Remove the rule afterwards. 2. In pfSense, the alert shows up under Services → Suricata → Alerts 3. In NxtFireGuard, open Events → Threat Events and filter for your pfSense sensor. Events → Processing shows every message the collector received, including rejected ones.

On the aggregator host you can check that packets arrive:

sudo tcpdump -ni any udp port 1028

Troubleshooting#

Block Attackers on pfSense#

The same firewall can block what NxtFireGuard reports:

1. In the dashboard, open your blocklist and copy its URL
2. In pfSense, go to Firewall → Aliases → URLs and add an alias of type URL Table (IPs) with the blocklist URL (use URL (IPs) only for lists under 3,000 entries)
3. Add a block rule at the top of your WAN rules with the alias as the source

See Blocklists for thresholds and update intervals.

Additional Resources#

• OPNsense Integration Guide
• pfSense Suricata package documentation
• pfSense remote logging

Support#

• pfSense / Suricata configuration: see the Netgate documentation and forum
• NxtFireGuard integration: contact NxtFireGuard support