Uptime monitoring for pfSense

pfSense is the most popular open-source firewall and router platform, built on FreeBSD and deployed in thousands of organizations as their network perimeter. It handles routing, firewalling, VPN termination, traffic shaping, and captive portal — often all at once. When pfSense goes down or becomes unreachable, your entire network perimeter fails. The web management interface going down is often the first sign of deeper problems.

This tutorial covers production-grade uptime monitoring for pfSense using Vigilmon. We will walk through:

• Monitoring the pfSense web management interface (HTTPS availability)
• WAN uptime check for the external interface
• Captive portal availability monitoring
• SSL certificate alerts for the management UI cert
• Heartbeat monitoring for scheduled pfSense backups

Prerequisites

• pfSense 2.7+ (CE or Plus edition)
• Access to the pfSense web GUI and SSH
• A free account at vigilmon.online

Part 1: Confirm the management interface is externally reachable

pfSense's web GUI runs on port 443 (HTTPS) by default, bound to the LAN interface. For Vigilmon to poll it, either:

Option A — monitor from a host on the LAN/management VLAN (recommended for secure environments). Deploy a small heartbeat relay agent on an internal host that polls pfSense and forwards heartbeats to Vigilmon.

Option B — expose the GUI on a dedicated management IP reachable from the internet. Lock it down to Vigilmon's monitoring IP ranges via pfSense's own firewall rules.

To add a firewall rule in pfSense allowing Vigilmon's probe IPs to reach port 443 on the WAN:

1. Navigate to Firewall → Rules → WAN.
2. Click Add (top of list).
3. Set:
   • Action: Pass
   • Interface: WAN
   • Protocol: TCP
   • Source: Vigilmon monitoring IP range (see your Vigilmon dashboard)
   • Destination: This firewall (self)
   • Destination Port: HTTPS (443)
   • Description: Vigilmon management UI check
4. Click Save and Apply Changes.

Verify the GUI responds:

curl -k -o /dev/null -w "%{http_code}" https://pfsense.example.com/

Expected: 200 (or 302 redirect to /index.php).

Part 2: Monitor the pfSense web management interface

1. Log in to vigilmon.online and click Add Monitor.
2. Choose HTTP(S) monitor.
3. Enter: https://pfsense.example.com/
4. Set interval to 1 minute.
5. Set expected status code to 200 or 302.
6. Add a keyword check: must contain pfSense (present in the login page title).
7. Add your alert channel.
8. Click Save.

The keyword check confirms you are reaching the actual pfSense login page, not an intermediate device or cached error page.

Part 3: WAN uptime check

Monitoring pfSense from inside the LAN does not catch WAN link failures. Add a check from the internet perspective to confirm your WAN interface is up and routing correctly.

The simplest approach is to monitor any service you host behind pfSense — your web server, VPN endpoint, or public API. If that service goes down and pfSense is up, you know the problem is the service. If pfSense itself goes unreachable, you know the WAN is down.

Add a TCP monitor for a service behind pfSense:

1. Click Add Monitor → TCP monitor.
2. Enter your public IP or hostname and a port for a service you host (e.g., port 443 for your web server).
3. Set interval to 1 minute.
4. Add your alert channel.
5. Click Save.

Pair this with the management interface HTTP check. If both go down simultaneously, the WAN link is the likely cause. If only the service check fails, investigate the backend service while pfSense itself is still healthy.

For a direct WAN check, expose a dedicated health endpoint on the WAN:

1. In pfSense, go to Services → System Patches (or use pkg install via SSH) to install a small web daemon, or use Diagnostics → Execute Command to run a test.
2. Alternatively, check pfSense's built-in XMLrpc endpoint from a trusted IP:

# Test from an external machine
curl -k --max-time 10 https://pfsense.example.com/xmlrpc.php | head -5

If you get an XML response (even an auth error), the management interface is reachable over WAN.

Part 4: Captive portal availability

If you use pfSense's captive portal (for guest Wi-Fi, hotel networks, or public access), monitor its availability independently — a captive portal failure does not always take down the main GUI.

Get your captive portal URL from Services → Captive Portal → Zone Settings → Portal page URL, typically:

https://pfsense.example.com:8002/

Add a Vigilmon monitor:

1. Click Add Monitor → HTTP(S) monitor.
2. Enter: https://pfsense.example.com:8002/ (or your portal zone URL).
3. Set interval to 5 minutes.
4. Add a keyword check: must contain a string from your captive portal welcome page (e.g., Connect to WiFi).
5. Add your alert channel.
6. Click Save.

This catches captive portal process crashes independently of the main GUI health.

Part 5: Heartbeat monitoring for scheduled pfSense backups

pfSense configuration backups are critical — restoring a pfSense appliance from a corrupted or missing backup can take hours. Schedule automated backups and send heartbeats to Vigilmon so you know they ran.

Schedule an automated backup via cron

pfSense ships with a package called AutoConfigBackup (for Plus users) or you can use a shell script with cron:

#!/usr/bin/env bash
# /usr/local/bin/pfsense-backup.sh (run on pfSense via SSH)

set -euo pipefail

BACKUP_DIR="/root/backups"
BACKUP_FILE="$BACKUP_DIR/config-$(date +%Y%m%d-%H%M%S).xml"
HEARTBEAT_URL="https://vigilmon.online/api/heartbeat/YOUR_TOKEN"

mkdir -p "$BACKUP_DIR"

# Export the current config
cp /conf/config.xml "$BACKUP_FILE"
echo "[$(date)] Config backed up to $BACKUP_FILE"

# Optionally sync to remote storage
# scp "$BACKUP_FILE" user@backup-server:/backups/pfsense/

# Remove backups older than 30 days
find "$BACKUP_DIR" -name "config-*.xml" -mtime +30 -delete
echo "[$(date)] Old backups pruned"

# Signal Vigilmon
curl -fsS --retry 3 "$HEARTBEAT_URL" > /dev/null
echo "[$(date)] Heartbeat sent to Vigilmon"

Add to pfSense cron via Services → Cron (if the cron package is installed) or via Diagnostics → Edit File to edit /etc/crontab:

# Run backup daily at 2:00 AM
0  2  *  *  *  root  /usr/local/bin/pfsense-backup.sh >> /var/log/pfsense-backup.log 2>&1

Create the heartbeat monitor in Vigilmon

1. In Vigilmon, click Add Monitor → Heartbeat monitor.
2. Name it: pfSense config backup.
3. Set expected interval to 24 hours.
4. Set grace period to 1 hour.
5. Copy the heartbeat URL and paste it into the script above.
6. Click Save.

If the backup script fails (disk full, config file missing, network error), it exits before the heartbeat ping. Vigilmon alerts you the next morning before the backup gap becomes a disaster.

Part 6: SSL certificate monitoring

The pfSense management UI uses either a self-signed certificate (default) or a certificate you import from Let's Encrypt or an internal CA. Both can expire:

1. In Vigilmon, click Add Monitor → SSL monitor.
2. Enter your pfSense hostname: pfsense.example.com.
3. Set alert threshold to 14 days before expiry.
4. Add your alert channel.
5. Click Save.

Check the cert expiry manually:

openssl s_client -connect pfsense.example.com:443 </dev/null 2>/dev/null \
  | openssl x509 -noout -dates

To use a proper certificate on pfSense:

1. Navigate to System → Cert. Manager → Certificates.
2. Import or generate a Let's Encrypt certificate using the ACME package (System → Package Manager → Available Packages → search for acme).
3. Once issued, go to System → Advanced → Admin Access and select the new certificate under SSL/TLS Certificate.

Let's Encrypt certificates expire every 90 days. Vigilmon's 14-day alert gives you time to renew manually if the automated ACME renewal fails.

Part 7: Webhook alerts for firewall events

Route Vigilmon DOWN/UP events to your team:

// Webhook receiver for pfSense monitoring events
import express from 'express';

const app = express();
app.use(express.json());

app.post('/webhook/vigilmon', (req, res) => {
  const { monitor_name, status, url, checked_at, response_time_ms } = req.body;

  if (status === 'down') {
    console.error('[VIGILMON] CRITICAL: pfSense monitor DOWN', {
      monitor: monitor_name,
      url,
      at: checked_at,
    });
    // Page on-call — pfSense failures are network-wide outages
    notifyOnCall({ service: 'pfSense', monitor: monitor_name });
  } else if (status === 'up') {
    console.info('[VIGILMON] pfSense monitor recovered', {
      monitor: monitor_name,
      responseMs: response_time_ms,
    });
  }

  res.sendStatus(204);
});

app.listen(3000);

Or use Vigilmon's native Slack integration to post directly to a #network-alerts channel.

Summary

Your pfSense deployment now has five layers of monitoring:

1. Management UI HTTPS check — confirms pfSense is alive and serving the web GUI, with a keyword check for the pfSense page title.
2. WAN uptime check — monitors a public-facing service behind pfSense to catch WAN link failures from the outside.
3. Captive portal check — independently monitors the captive portal process (if in use).
4. Heartbeat monitor — your daily backup script pings Vigilmon; missing pings mean the backup failed.
5. SSL certificate monitor — alerts you 14 days before the management UI cert expires.

Vigilmon handles check scheduling, multi-region polling, alert routing, and uptime history. You get notified within 60 seconds of any failure in your pfSense firewall stack.

Monitor your pfSense infrastructure free at vigilmon.online

#pfsense #firewall #networking #monitoring #devops #freebsd