pfSense Firewall & Security — Loki / Alloy

pfSense Firewall & Security — Loki / Alloy

A Grafana community dashboard for pfSense firewall and security logs collected through Grafana Alloy and stored in Grafana Loki.

What this dashboard shows

• Total syslog and firewall events
• Blocked and passed traffic
• Block vs pass time series
• Firewall action distribution
• Top interfaces
• Inbound vs outbound traffic
• IPv4 vs IPv6
• Top IPv4 protocols
• Top 10 blocked source IPv4 addresses
• Top 10 destination IPv4 addresses
• Top 10 blocked destination TCP/UDP ports
• Top pfSense rule tracker IDs generating blocks
• Syslog severity
• Top applications/processes
• Detailed filterlog logs
• System / IDS / Suricata / other pfSense logs

Architecture

pfSense
  |
  | Syslog UDP/514
  v
Grafana Alloy
  |
  v
Grafana Loki
  |
  v
Grafana

Expected Loki labels

The dashboard expects pfSense logs to be available with:

{job="pfsense"}

Firewall logs should have:

{job="pfsense", app="filterlog"}

The reference Alloy setup maps common RFC3164 syslog metadata to labels such as:

• hostname
• app
• severity
• facility
• source_ip
• job
• protocol
• source

The dashboard intentionally avoids turning source/destination IP addresses and ports into permanent Loki stream labels. Those fields are parsed at query time to avoid ingestion-time high cardinality.

Loki requirement for high-cardinality Top-N panels

The Top-N IP/port/rule panels use approx_topk(). This LogQL function was introduced in Loki 3.3 and is designed for cases where regular topk() can hit the maximum series limit.

Enable it in Loki:

frontend:
  encoding: protobuf
query_range:
shard_aggregations: approx_topk
limits_config:
shard_aggregations:
- approx_topk

Restart Loki after validating the configuration.

Tested stack

Reference environment used while building and validating this dashboard:

• Grafana 13.1.0
• Loki 3.7.3
• Grafana Alloy 1.17.1
• pfSense remote syslog over UDP/514
• Loki TSDB schema v13
• Single-node/self-hosted deployment

Loki 3.3+ is required for approx_topk().

Import

1. In Grafana, go to Dashboards → New → Import dashboard
2. Upload the JSON file
3. Select your Loki datasource when prompted
4. Import
5. Start with a 15- or 30-minute time range and increase as needed

Notes

The pfSense filterlog format is CSV-like. This dashboard parses the common firewall header and IPv4 protocol fields at query time with LogQL pattern.

Because pfSense environments can differ by version, interface naming, enabled packages, IDS/Suricata configuration and logging options, individual queries may require small adjustments.

Security / privacy

This public dashboard contains no real hostnames, internal IP addresses, credentials, organization names or environment-specific secrets.

License / reuse

You may reuse and adapt the dashboard for your environment. Attribution is appreciated.