Realtime pfSense Firewall Attack Logs in Splunk + Google Maps with GeoIP

I’ve been doing some pretty interesting things with Splunk lately, and finally got around to toying with the Google Maps Splunk app. I was able to find a couple of boiler plate Splunk configuration files from another blog post, that needed some tweaks to get going properly. I’ve create a Youtube video demonstrating the abilities for visualizing pfSense firewall attacks in Google Maps, using the MAXMIND GeoIP plugin for translating the IP addresses into coordinates.

This can be viewed historically or in real-time as the video above demonstrates.

Setup Guide

This tutorial will presume that you have a working pfSense router and a Splunk server deployed. There are a couple of ways that you can get the pfSense firewall logs over to the Splunk server; this guide will use the Syslog over UDP component from the pfSense machine, sending to a UDP Syslog listener on the Splunk server.

In this guide, I will be using:

Splunk v4.3.1
pfSense 2.1-Development

Splunk Configuration: Setup Files

First, we need to create a couple of files on the Splunk server. If you have not done so already, you can set the $SPLUNK_HOME environment variable with the follwing command “export SPLUNK_HOME=/opt/splunk”, changing the path to fit your installation.

$SPLUNK_HOME/etc/system/local/props.conf

[source::udp:514]
TRANSFORMS-pfsense-firewall = pfsense-firewall
SHOULD_LINEMERGE = true
TRUNCATE = 0
MUST_NOT_BREAK_AFTER = pf: .* rule ([-\d]+\/\d+)\(.*?\):
MUST_BREAK_AFTER = pf: .* (<|>) +(\d+\.\d+\.\d+\.\d+)\.?(\d*)\:
REPORT-pfsense-firewall = pfsense-firewall

$SPLUNK_HOME/etc/system/local/transforms.conf

[pfsense-firewall]
REGEX = .* (?<action>pass|block) .* (?<protocol>TCP|UDP|IGMP|ICMP) .* (?<src_ip>(\d+\.\d+\.\d+\.\d+))\.?(?<src_port>(\d*)) [<|>] (?<dest_ip>(\d+\.\d+\.\d+\.\d+))\.?(?<dest_port>(\d*)): (.*)
CLEAN_KEYS = 1
MV_ADD = 0

Save these two files and chown splunk:splunk $SPLUNK_HOME/etc/system/local/*.conf

Splunk Configuration: Setup UDP Input

The next thing to do is setup the Splunk server to listen on a UDP port to collect the firewall logs from the pfSense router. This is done by navigating in the Splunk web UI to:

Manager > Data Inputs > UDP > New

For the UDP port, choose port 514. This is the default UDP port pfSense will send to (this can be changed, but goes beyond the scope of this guide).

Set the sourcetype to Manual and enter pfsense-firewall as the type. Optionally choose Host, Index and Restriction settings and save.

Restart the Splunk server with $SPLUNK_BIN/bin/splunk restart, or from your init script if you have one configured.

Splunk Configuration: Install Google Maps and MAXMIND

These two apps can be installed from the Splunk App Manager (and they usually appear in the first page of results when navigating to the Find more apps link. No special configuration changes are needed for getting this going for either of the two Splunk apps.

pfSense Configuration

From the pfSense web UI, browse to: Status > System Logs and click the Settings tab. Check the Send log messages to remote syslog server checkbox, and enter the IP address of your Splunk server.

Save the settings and return to the Splunk web UI.

Google Maps Test Drive

At this point, your pfSense firewall should be logging firewall events to the Splunk server, and the events should appear under the pfsense-firewall sourcetype in the main Search dashboard. If the pfSense router is internal to the network, and does not have any traffic hitting it from it’s WAN side, you may have to be creative with a tool such as Nmap to “wake it up” and produce firewall events.

Once you have confirmed that events are being logged in Splunk, drill down into the pfsense-firewall sourcetype in the search dialog and ensure that the following fields are being shown: