Source
r/PFSENSE•
amexoiss

Remote logging of pfSense (Netgate SG-3100) -> splunk light (win10) not working???

I followed the directions here to enable remote logging on the default port 514 from my pfsense box (PC's VLAN only) to my pc with splunk. Sending everything.

I also followed the directions here to enable UDP monitoring in splunk on port 514.

Absolutely nothing. There are logs being generated that I can see on the pfsense log page.

I also allowed port 514 UDP in windows firewall to "local" networks.

Still nothing.

Added firewall rule PC's VLAN pass IPv4+6 any protocol to "this firewall".

Still nothing.

Tried like 6 other instructions for doing the above... all largely identical to the two links above. I did run across a few that want me to install some custom package to add a splunk forwarding thing to the pfsense box, but I don't think that will work because the SG-3100 isn't an intel processor.

Nothing.

Tearing my hair out on this one... google top results make it seem so straightforward. I'm sure I'm just missing something obvious. Please help.

Posted Dec 23, 2019, 12:52 AM UTC

01
jim-p•

There isn't much to do on pfSense here, just enable remote syslog, plug in an IP address, pick which events to send, and save. You should not need any firewall rules on pfSense as this is outgoing traffic.

It's almost certainly a problem on the receiving side.

Your next steps are:

  1. Packet capture on pfSense to see if the syslog messages are leaving going toward the log server.
  2. Packet capture on the log server to see if the syslog messages are received there.

If 1 and 2 both show log data, then it's definitely a problem in the local system configuration on the Splunk system.

2