The pfSense is the gateway for my local lan. This help lessen the work load for pfSense machine itself, and it could be useful for your use case.I am struggleing on propper configuration of my setup and doesn't get the knot loosen. There is tons of data, because of this the storage requirement is huge. With the imported ‘Dashboard’ you can see a list of pre made dashboards for NetFlow

Just put a wildcard ‘*’ to tell it to use all. Goto Management>’Index Patterns’ and click on ‘Create Index Pattern’. Once import is successful, we need to make a index pattern for the dashboard to retrieve the Netflow. Select the elestiflow.kibana.7.5.x.ndjson file to import. Right click ‘Download’ button and ‘Save Link As’, make sure it does not save as. To import the dashboard you need to go to Management>’Saved Objects’ and click on ‘Import’

It will initially show nothing and it need to import a ready made dashboard to become useful. You can access Kibana that will visualise the Elasticsearch data, by accessing it via Address]:5601. # JVM Heap size - this MUST be at least 3GB (4GB preferred)ĮLASTIFLOW_DEFAULT_APPID_SRCTYPE: '_UNKNOWN' Image: robcowart/elastiflow-logstash-oss:3.5.3 # - for production environments upto 31GB is recommended. # - this should be at least 2GB for simple testing, receiving only a few flows per second. Image: /elasticsearch/elasticsearch-oss:7.5.0Ĭontainer_name: elastiflow-elasticsearch-oss This will use robcowart/elastiflow-logstash-oss docker, you can checkout the docker here Give the application a name, and then copy this YAML configuration for Elasticsearch.

On your QNAP you must create the docker using the ‘Create Application’, this uses the Docker Compose editor to create the docker instance without using a GUI. NetFlow port ‘2055’, Sampling is down to your needs, NetFlow version ‘9’, Flow Tracking Level to ‘Full’ to log everything. Host will be the I.P that is hosting the docker. Here you must enable softflowd, then state all the interface you wish to monitor. With the use of NetFlow you can do this with softflowd package.įirst install softflowd via System>Package Manager, once installed you need to edit the settings for softflowd in the ‘Services’ tab. If your pfSense does not have the performance or has huge storage of handling a network probe such as ntopng package, you can send your logs to an external system.

Pfsense docker