tutorial

How to Monitor IPFire with Vigilmon

IPFire is a hardened Linux firewall distribution with Suricata IDS/IPS, multi-zone networking, and VPN support. This guide shows you how to monitor the web admin interface, IDS engine, VPN tunnels, DNS, DHCP, and WAN link health from outside the firewall using Vigilmon.

IPFire is a hardened, community-maintained Linux firewall distribution that provides stateful packet inspection, Suricata-based IDS/IPS, multi-zone networking (RED/GREEN/BLUE/ORANGE), and VPN services (IPsec, OpenVPN, WireGuard). As your network's perimeter defence, it's the last thing you want to go down unnoticed.

This tutorial shows you how to monitor IPFire's web interface, core firewall services, VPN tunnel health, DNS resolver, DHCP server, and WAN connectivity using Vigilmon — all from outside your firewall where the probes can detect true perimeter failures.

What You'll Set Up

  • Web admin interface availability monitor (HTTPS on port 444)
  • WAN link state monitor (external internet connectivity)
  • VPN tunnel health checks (IPsec, OpenVPN, WireGuard)
  • DNS resolver service check (unbound)
  • Suricata IDS/IPS heartbeat
  • DHCP server service heartbeat
  • IPFire pakfire update server reachability check
  • TLS certificate expiry alert for the admin interface

Prerequisites

  • A running IPFire installation (2.x or later)
  • The RED (WAN) interface connected to the internet
  • Access to IPFire's admin interface from a management network
  • A free Vigilmon account

Step 1: Monitor the Web Admin Interface

IPFire's web-based admin interface runs on port 444 over HTTPS. If the web server process crashes or the machine becomes unreachable, you lose all GUI management access.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. URL: https://your-ipfire-mgmt-ip:444/
  4. Set Expected HTTP status to 200 or 302.
  5. Set Check interval to 1 minute.
  6. Click Save.

Tip: Monitor this from the GREEN (LAN) or management network side if Vigilmon is running from within your network. If monitoring externally, ensure your RED interface's firewall rules allow inbound probes to port 444 — though for security you may prefer to restrict this to a VPN-only path and monitor via that tunnel.

Step 2: Monitor WAN Link State (Internet Connectivity)

The most critical thing IPFire does is maintain internet connectivity. A dead WAN link means all internal clients lose access. Monitor this by probing a reliable external target from inside your network via a cron heartbeat on the IPFire box.

Add the following cron job on the IPFire system (via System → Scheduler in the IPFire web UI or by editing /etc/fcron.weekly):

#!/bin/bash
# Ping external DNS to confirm WAN is up, then heartbeat Vigilmon
if ping -c 3 -W 5 8.8.8.8 > /dev/null 2>&1; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_WAN_HEARTBEAT_ID
fi

Add to /etc/cron.d/wan-monitor:

*/2 * * * * root /opt/scripts/check-wan.sh
  1. Click Add Monitor → Cron Heartbeat in Vigilmon.
  2. Set expected interval to 2 minutes.
  3. Copy the heartbeat URL into the script.

If the WAN link drops, the script can't reach Vigilmon's heartbeat URL, the ping is skipped, and Vigilmon alerts after one missed interval.

Step 3: Monitor VPN Services

IPFire supports IPsec, OpenVPN, and WireGuard. A VPN service failure can cut off remote workers or site-to-site links silently.

OpenVPN

OpenVPN's management port provides a live status check. Enable it in your OpenVPN server config (/etc/openvpn/server.conf):

management 127.0.0.1 7505

Then use a TCP check from Vigilmon:

  1. Click Add Monitor → TCP Port.
  2. Host: your-ipfire-external-ip, Port: 1194 (or your custom port).
  3. Check interval: 2 minutes.
  4. Click Save.

A TCP check on port 1194 (UDP by default) needs to be adapted to TCP if you run OpenVPN in TCP mode. Alternatively, use a cron heartbeat inside your VPN tunnel to verify end-to-end connectivity.

WireGuard

Use a cron heartbeat on a WireGuard peer to verify tunnel health:

#!/bin/bash
# Run on a WireGuard client/peer
if ping -c 2 -W 3 10.0.0.1 > /dev/null 2>&1; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_WG_HEARTBEAT_ID
fi

IPsec

Check the IKE daemon (strongSwan/Pluto) TCP management port or use a cron heartbeat that polls ipsec status:

#!/bin/bash
if ipsec status | grep -q "ESTABLISHED"; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_IPSEC_HEARTBEAT_ID
fi

Step 4: Monitor the DNS Resolver (unbound)

IPFire uses unbound as a local caching DNS resolver for all LAN clients. If unbound dies, DNS resolution fails network-wide — symptoms look like internet being down even when the WAN link is fine.

Create a cron heartbeat that queries unbound directly:

#!/bin/bash
# Query unbound on localhost; ping Vigilmon if it resolves successfully
if dig +short @127.0.0.1 vigilmon.online A | grep -qE '^[0-9]+\.'; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_DNS_HEARTBEAT_ID
fi

Add to cron every 2 minutes. In Vigilmon, set the expected interval to 2 minutes.

Step 5: Monitor the DHCP Server

IPFire can serve DHCP for your LAN/WLAN zones via dhcpd. A DHCP server failure means new clients and reconnecting devices can't get addresses.

Add a service status check via cron:

#!/bin/bash
# Check if dhcpd is running and responding
if systemctl is-active --quiet dhcpd; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_DHCP_HEARTBEAT_ID
fi

If IPFire uses a non-systemd init, check the process directly:

if pgrep -x dhcpd > /dev/null; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_DHCP_HEARTBEAT_ID
fi

Step 6: Suricata IDS/IPS Engine Heartbeat

If you have Suricata enabled for intrusion detection/prevention, a Suricata crash silently removes your IDS coverage without affecting routing. Add a heartbeat:

#!/bin/bash
if pgrep -x suricata > /dev/null; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_SURICATA_HEARTBEAT_ID
fi

Set the Vigilmon heartbeat interval to 5 minutes. You should also monitor Suricata signature update recency — stale signatures mean new threats are undetected:

#!/bin/bash
RULES_FILE="/etc/suricata/rules/emerging-threats.rules"
LAST_UPDATE=$(stat -c %Y "$RULES_FILE")
NOW=$(date +%s)
AGE=$(( (NOW - LAST_UPDATE) / 3600 ))  # age in hours

if [ "$AGE" -lt 25 ]; then  # alert if rules are older than 25 hours
  curl -sf https://vigilmon.online/heartbeat/YOUR_SURICATA_RULES_HEARTBEAT_ID
fi

Step 7: Monitor IPFire Pakfire Update Server Reachability

IPFire's package manager (pakfire) needs to reach update servers to pull security patches. If update servers are unreachable, you won't get automatic security updates.

Add an HTTP check for pakfire's main update server:

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: https://pakfire.ipfire.org/
  3. Expected status: 200 or 301.
  4. Check interval: 60 minutes (this doesn't need to be frequent).
  5. Click Save.

This confirms that your IPFire box has outbound internet access to the update infrastructure.

Step 8: TLS Certificate Expiry for the Admin Interface

IPFire generates a self-signed certificate by default for the port 444 admin interface. If it expires, browser warnings will make the admin UI inaccessible in practice.

  1. Open the admin interface HTTP monitor from Step 1.
  2. Enable Monitor SSL certificate.
  3. Set Alert when certificate expires in less than 30 days.
  4. Click Save.

If you've replaced the self-signed cert with one from Let's Encrypt, reduce the alert window to 21 days since renewal is automated.

Step 9: Configure Alert Channels

  1. Go to Alert Channels → Add Channel.
  2. Add email, Slack, or a webhook for on-call notification.
  3. For the admin interface and WAN monitors, set Consecutive failures before alert to 1 — these are critical.
  4. For DNS, DHCP, and VPN monitors, set to 2 to absorb brief restarts.
  5. For Suricata and pakfire checks, set to 3 — transient process restarts shouldn't page you.

Summary

| Monitor | Type | Target | What It Catches | |---------|------|--------|-----------------| | Admin UI | HTTP | :444 | Web server crash, IPFire unreachable | | WAN link | Heartbeat | External ping via cron | Internet connectivity loss | | OpenVPN | TCP | :1194 | VPN service down | | WireGuard | Heartbeat | Tunnel ping via cron | WireGuard tunnel failure | | IPsec | Heartbeat | ipsec status via cron | IKE daemon down | | DNS (unbound) | Heartbeat | Localhost dig via cron | DNS resolution failure | | DHCP (dhcpd) | Heartbeat | Process check via cron | DHCP service down | | Suricata | Heartbeat | Process check via cron | IDS/IPS engine crash | | Pakfire | HTTP | pakfire.ipfire.org | Update server unreachable | | Admin TLS | SSL | Port 444 | Certificate expiry |

IPFire is your network's last line of defence — and the one service whose failure cascades to everything else. With Vigilmon watching the admin interface, WAN connectivity, VPN tunnels, DNS, and core service health, you get immediate alerts when your firewall needs attention.

Get started free at vigilmon.online — no credit card required.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles