PfSense Exporting NetFlow with softflowd

pfSense® software is a free, open source customized distribution of FreeBSD specifically tailored for use as a firewall and router that is entirely managed via web interface. In addition to being a powerful, flexible firewalling and routing platform, it includes a long list of related features and a package system allowing further expandability without adding bloat and potential security vulnerabilities to the base distribution. So, you will learn how to exporting NetFlow with Softflowd on PfSense.


The pfSense project is hosted and developed by Rubicon Communications, LLC (Netgate).

LICENSE
pfSense is open source and distributed under the Apache 2.0 license.

Installing softflowd

softflowd is a NetFlow collector that can be deployed on pfSense® software

There is a package available under System > Packages on the Available Packages tab. Find it in the list, click 

at the end of its row, and confirm the installation.

To check if the installation is OK, go to Installed Packages. The screen should be similar to the picture below:

To access NetFlow Configuration go to Services/Softflowd.

Host – Enter the IP address of the computer you want to receive the NetFlow traffic data. So, this is the location where you will want to run the NetFlow analyzer client from.

Port This setting controls the destination UDP port for the NetFlow datagrams. Most clients use port 2205 by default so in most cases this is what you should enter.

Source Hostname/IP This setting controls which interface the pfSense system will use to send the NetFlow packets from. Usually you’ll want to enter the IP address of the LAN interface of the pfSense box. You can find the IP in the status/interfaces menu.

pfSense Rule Direction Restriction – Leave this set to any to capture traffic in both directions. If desired you can capture a single direction of traffic.

NetFlow Version – Most clients should support version 9. So, if you’re NetFlow analyzer only supports an older version you can configure it with this setting.

So, once you save the settings, pfflow will begin sending NetFlow packets to the destination IP address specified in the settings.

After the basic NetFlow configurations, we have Timeout options. Timeout options are usually left unconfigured, however if you want to set some timeouts or to group flows into NetFlow packet here is the place to do it:

EventLogControlling softflowd from the Command Line

To view statistics about the running softflowd process, run the following command, replacing em0 with the actual network interface to query:

: softflowctl -c /var/run/softflowd.em0.ctl statistics

So, to expire all flows and force an update to the server. Run the following command, replacing em0 with the actual network interface to control:

: softflowctl -c /var/run/softflowd.em0.ctl expire-all

Abdullah
Senior Devops Engineer

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest articles

You might also likeRELATED

Pfsense High Availability

This post is about pfSense High Availability This recipe describes a simple three interface HA configuration. The three interfaces are LAN, WAN, and Sync. This...

Pfsense Bridging

This post is about pfsense bridging. Normally each interface on the pfSense® firewall represents its own broadcast domain with a unique IP subnet. In some...

Suricata Setup on pfSense

This post is about Suricata Setup on pfSense Install the Suricata Package pfSense provides a UI for everything. So from the admin page go to System -> Package Manager -> Available...