OPNsense

Configure the source in NeQter before enabling its syslog sender. The screenshots below use fictional examples; replace the example address with the actual sender address that reaches your appliance.

Step 1: NeQter Input Setup

1. Open Settings → Inputs → Syslog and select Add input.
2. Enter a descriptive Label and the sending device’s IP address. Account for any relay or source address translation. This field identifies the sender, not the NeQter destination.
3. Select OPNsense under Manufacturer. Review the optional DNS resolution, tags, and dashboard choice.
4. Select Save to create the input. Cancel closes an unsaved draft.

NeQter drops syslog messages that do not match a configured input. See Syslog setup for source matching and reception checks.

Step 2: NeQter Dashboard Setup

1. Open Settings → Dashboards and find OPNsense.
2. Turn on Enable index if needed, then select the supplied dashboard checkboxes you want.
3. Select Apply changes at the top of the page to save the pending selections.

Open enabled dashboards through Logs → Dashboards. Selecting dashboards does not configure the sender or establish that logs are arriving.

Step 3: Opnsense Configuration

1. Log in to OPNsense.

2. Navigate to System → Settings → Logging on the left nav bar.

3. Open the Remote tab on the top navigation bar.

4. Click Add and configure the following:

• Enabled: Checked as enabled.
• Transport: Select TCP(4).
• Applications: Select required logs, or use Select All option underneath dropdown if unsure.
• Level: Select all except Debug (recommended to avoid noise).
• Facilities: Use Select All option underneath dropdown unless you have a specific filtering need.
• Hostname: Enter the NeQter IP address.
• Port: 514.
• rfc5424: Checked as enabled.

5. Click Save.

Barring misconfigurations, traffic should be visible in NeQter within an hour. If no new traffic is seen after following the above steps, contact support here for further assistance.

Return to Input Configuration

---