DumbMonit
IntegracionesRed y cortafuegos
Monitorizar OPNsense con DumbMonit
Gateway latency and loss, VPN tunnels, DHCP leases, services and pending updates.
DocumentaciónSitio web oficial: OPNsense
Las descripciones están en inglés, como en el producto. Las etiquetas de la página siguen su idioma.
Qué vigila DumbMonit
Open source firewall and router: the state of every gateway with its round-trip time and packet loss, the pf state table, interface counters and addresses, VPN tunnels, DHCP leases, the resolver, services, CARP and pending updates. This integration was built and verified against OPNsense 26.1, the official image started in a virtual machine for the purpose, with the restricted API key described below — not against a firewall that has been routing a household's traffic for years. Every call is a read and every shape comes from that real OPNsense, but its gateways had no monitor address, it was not part of a CARP pair and ran no OpenVPN or IPsec tunnel: those parts follow OPNsense's source…
Uso habitual. Firewall, router, multi-WAN edge
Ejemplos
- OPNsense firewall
- Home router
- Multi-WAN edge
Cómo se conecta
Qué necesita
- API key and secretThe two lines of the file OPNsense downloads when the key is created.
Puertos de red que abrir
443/TCPAPI (HTTPS, default)80/TCPOnly with the HTTP protocol option
Pasos de configuración: Create a read-only API key in OPNsense
System → Access → Groups → Add: name the group as follows.
dumbmonitIn that group, under Assigned Privileges, add the privileges listed below.
System → Access → Users → Add: name the user as follows, generate a password, and make it a member of that group.
dumbmonitEdit the user, click + under API keys, and save the downloaded file: it holds the key and the secret, shown only once.
In DumbMonit, enter the firewall address (192.168.1.1 or fw.lan:8443), the key as API key and the secret as API secret.
Ojo. An API key is a password that never expires: restrict the group's source networks to the DumbMonit host and never grant All pages. OPNsense ships a self-signed certificate: tick "Accept an unverifiable certificate" if the connection is refused.