Pfsense: best/recommended way to log all outgoing traffic from IP on my LAN?

Networking & Firewalls
1

Hi!

I’ve had a Netgate pfSense firewall guarding my home LAN for almost a year now, but since I work with other things than computers I never find the time to “advance to the next level” in understanding pfSense. I hope the forum can suggest which route would be best for me to pursue given what I want to achieve (below).

I recently installed a RaspberryPi media server that plays music from my freeNAS to my hifi.

What is the best way to find out exactly what connections the raspberry pi (10.0.0.45) establishes to the internet?

I have tried creating a PASS rule on the LAN interface for any ports from source 10.0.0.45 to destination “inverted LAN net” and to have those passes logged. To my understanding that should capture traffic out to the internet from the device. But nothing ever shows up in the logs (when I filter on 10.0.0.45 as source) even though I know for a fact that some traffic is occurring because I can listen to internet radio via the device.

I see people on the internet lamenting that pfSense has poor traffic monitoring capabilities since bandwidthD was deprecated. Others say ntopng is the proper tool to use but it strikes me as overkill for what I want to do. I am thinking vanilla pfSense should be able to do what I want, but maybe I just have not grasped how to do it?

I’d appreciate a push in the right direction.
Thanks!

2

Try using the DarkStat plugin, it works well to track by IP where things are going

3

Hi Tom,
Thanks for your youtube videos. Highly appreciated.
It seems darkstat collects info on bandwidth used by each host. I probably wasn’t clear enough in my original post but what I want is to see what external hosts the raspberry pi connects to (who it tries to talk to outside of my LAN). Perhaps ntopng is the best bet after all. I installed it again now and this time it does not look as cryptic as last time when I could not figure things out at all.
I am curious though as to why the pfsense rule did not work, but I will have to resolve that another day when I have more time.