DumbMonit
Monitorare OPNsense con DumbMonit
Gateway latency and loss, VPN tunnels, DHCP leases, services and pending updates.
DocumentazioneSito ufficiale: OPNsense
Le descrizioni sono in inglese, come nel prodotto. Le etichette della pagina seguono la tua lingua.
Cosa controlla DumbMonit
Open source firewall and router: the state of every gateway with its round-trip time and packet loss, the pf state table, interface counters and addresses, VPN tunnels, DHCP leases, the resolver, services, CARP and pending updates. This integration was built and verified against OPNsense 26.1, the official image started in a virtual machine for the purpose, with the restricted API key described below — not against a firewall that has been routing a household's traffic for years. Every call is a read and every shape comes from that real OPNsense, but its gateways had no monitor address, it was not part of a CARP pair and ran no OpenVPN or IPsec tunnel: those parts follow OPNsense's source…
Uso tipico. Firewall, router, multi-WAN edge
Esempi
- OPNsense firewall
- Home router
- Multi-WAN edge
Come si collega
Cosa serve
- API key and secretThe two lines of the file OPNsense downloads when the key is created.
Porte di rete da aprire
443/TCPAPI (HTTPS, default)80/TCPOnly with the HTTP protocol option
Passaggi di configurazione: Create a read-only API key in OPNsense
System → Access → Groups → Add: name the group as follows.
dumbmonitIn that group, under Assigned Privileges, add the privileges listed below.
System → Access → Users → Add: name the user as follows, generate a password, and make it a member of that group.
dumbmonitEdit the user, click + under API keys, and save the downloaded file: it holds the key and the secret, shown only once.
In DumbMonit, enter the firewall address (192.168.1.1 or fw.lan:8443), the key as API key and the secret as API secret.
Attenzione. An API key is a password that never expires: restrict the group's source networks to the DumbMonit host and never grant All pages. OPNsense ships a self-signed certificate: tick "Accept an unverifiable certificate" if the connection is refused.