AZiT
no way out WireGuard tunnel tunnel down direct, but no DNS guests: direct, but no DNS direct: PS5 and guests igc1 igc2 igc3 igc4 igc5 port 2 Internet VPN provider WireGuard, fails closed Firewall OpenBSD and pf, six ports Admin 192.168.1.0/24 laptop, wired Access point one cable, four networks Management untagged, AP only Trusted, VLAN 10 phones, laptop IoT, VLAN 20 isolated clients Guest, VLAN 30 internet only PS5 192.168.3.0/24 direct route Media 192.168.4.0/24 Kodi Servers 192.168.5.0/24 DeskPi Super6c six Raspberry Pi CM5, one switch Kubernetes: 3 control, 2 workers cp1 cp2 cp3 w1 w2 Flux, Traefik, TLS SIEM sixth board: UniFi controller Raspberry Pi 3B Home Assistant

Logging pipeline is highlighted; its page is below.

Logging pipeline

pf writes each logged packet to a virtual interface. A small helper turns those packets into syslog lines carrying the rule's name, and syslogd sends them over TLS to the SIEM in the cluster.

The path#

Firewall pflogs a packet pflog0virtual interface pflog2syslogadds the rule name syslogdTLS, ISO timestamps syslog over TLS, port 6514, certificate verified Cluster Vectorparses, enriches OpenSearchdaily indices Dashboardssearch, maps Alertingtwo monitors
Every logged decision takes this path, and reaches OpenSearch within seconds.
  • pflog0. Every logged block, and every logged new connection, appears here as a packet.
  • pflog2syslog. An rc service reads pflog0 with tcpdump and appends label=<rule name> from a map it rebuilds at every start.
  • syslogd. Forwards over TLS, includes its hostname and writes ISO timestamps in UTC. It verifies the receiver against the home CA, and proves itself with a client certificate of its own: Vector accepts no connection without one.
  • Vector, in the cluster. Parses each line into structured fields and writes it to OpenSearch.

Configuration#

/etc/syslog.conf (forwarding line)
*.notice;local0.info;auth.info;authpriv.info	@tls://siem.internal:6514
  • Selector order matters: *.notice comes first, or it overrides the more specific entries after it.
/etc/rc.conf.local
syslogd_flags=-h -Z -C /etc/ssl/homelab-ca.crt
pkg_scripts=pflog2syslog
  • -h adds the hostname, -Z switches to ISO timestamps in UTC, -C names the CA that the receiver's certificate must chain to.

Build it yourself: Firewall logs into the SIEM, in the Cluster and SIEM guide

See also: SIEM