Add OPNsense by REST API - #808
Open
Garfieldttt wants to merge 4 commits into
Open
Conversation
Garfieldttt
force-pushed
the
opnsense-rest-api
branch
2 times, most recently
from
August 23, 2026 04:11
07555b3 to
48a038b
Compare
A second OPNsense template next to OPNsense by HTTP-JSON, derived from it
and considerably wider. It carries its own name and its own uuids, so both
can be linked to the same host and importing one does not touch the other.
Measured against a live OPNsense 26.7 rather than taken from documentation,
including the privilege table in the README, which is derived from the
patterns the firewall publishes under auth/priv/search.
127 items, 15 discovery rules with 71 item prototypes, 58 triggers, 41
macros and a dashboard of nine pages. Over the template it grew out of it
adds processor utilisation split into user, system and interrupt, the packet
filter in depth with the state and source tracking tables, pf counters,
table entries and the loaded ruleset, kernel network memory, netisr queues,
protocol error rates, clock synchronisation, service state, swap and
temperature discovery, inbound errors and link state per interface, the
Unbound resolver, certificate validity and DHCP lease counters.
Five defects of the original are fixed rather than carried over:
* diagnostics/firewall/pfStates and diagnostics/system/systemResources in
camelCase, where the privilege patterns are exact and ACL.php matches
them case sensitively, so a monitoring key gets HTTP 403
* IPsec phase 2 asking with a GET although searchPhase2Action reads its
connection from getPost('id'), so it could only return an empty set
* the literal 9999 substituted for round trip time, loss and deviation on
a gateway without a monitor address, which landed in history and made
the gateway graphs unreadable
* the CARP discovery turning unsupported on a firewall without CARP, where
an empty list is the correct answer
* fourteen raw master items keeping a day of raw payloads that nothing
reads, about 20 MiB a day per host
The export declares format 7.0, so it imports into Zabbix 7.0 and every
later release. Every widget type it uses exists in 7.0.
Garfieldttt
force-pushed
the
opnsense-rest-api
branch
from
August 23, 2026 04:29
48a038b to
027439d
Compare
|
thank you. i test. in a desktop openvpn i don't see a user connnect but a name of istance |
search_sessions returns one flat list in which a running server that has clients connected is represented by those clients alone, each carrying the description and type of its instance. Discovered as it stood, every session was named after the instance it belonged to, and the instance itself disappeared for as long as anybody was connected. A script on the master item now splits the answer into instances and sessions and rebuilds the instance from its sessions. Discovery follows in two rules: instances keep their items and their key, sessions are new and carry the client name, its source address and the traffic of that one client. Three more defects the same answer explains: - a server keeps no traffic counters of its own, so the instance figures were always empty. They are now the sum over the connected clients, and the rate steps are guarded because that sum drops when a client leaves - a client instance and a server in point to point mode report the state of their own tunnel, connected rather than ok, which made the down trigger fire on a healthy instance - an instance that is enabled but not running is returned with no status at all, which was discarded, so a dead instance never reached the trigger. It is reported as stopped Read off ServiceController::searchSessionsAction and ovpn_status.py and reproduced from their output, because the firewall this template was measured against runs no OpenVPN.
Contributor
Author
|
@burghy86 |
added 2 commits
August 24, 2026 21:11
An audit against the live firewall evaluated every item and prototype of
the template: 219 carry a value, none fail, and the six that stay empty are
the ones the README already explains, the gateway metrics without a monitor
address and the CARP discovery on a firewall without CARP.
Two things it did turn up:
- calculated items referenced their own host in two styles, twelve as
//key and eight as /{HOST.HOST}/key. Both work, the shorter one is what
the Zabbix templates use, so all twenty read the same way now
- the README claimed the UPS master answers HTTP 403 without the page-nut
privilege. It does, but on a firewall without the NUT plugin the route
does not exist at all and the answer is 404. Both cases are named now,
together with the reason the item ships disabled
The README says every raw item stores nothing, and every one of them did except the intermediate item of the filesystem discovery, which kept an hour of text per discovered filesystem without anything reading it. A dependent item is fed from the value as it arrives, so history 0 costs nothing and saves eleven text items per firewall here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OPNsense by REST API
A second OPNsense template next to
OPNsense by HTTP-JSON, derived from it and considerablywider. It carries its own name and its own uuids, so both can be linked to the same host and
importing one does not touch the other.
Everything below was measured against a live OPNsense 26.7 with a restricted monitoring key,
not taken from the documentation.
What it adds over the template it grew out of
table entries against the configured ceiling, and the loaded ruleset with size, fingerprint,
evaluation rate and unmatched rules
protocol error rates
107 items, 14 discovery rules with 70 item prototypes, 52 triggers, 36 macros.
Five defects of the original are fixed here rather than carried over
diagnostics/firewall/pfStatesanddiagnostics/system/systemResourcespf_statesandsystem_resources, exact rather than wildcards, andACL.phpmatches them withpreg_matchwithout theimodifier. An administrator key never notices, a monitoring key gets HTTP 403 on the firewall state items, the state table utilization and all memory itemssearchPhase2Actionreads its connection fromgetPost('id')and the template asked with a plain GET, so phase 2 could only ever return an empty row set. It is an item prototype inside the phase 1 rule now, posting one request per connectionget_vip_statusanswers with an emptyrowslist and a message saying no CARP interfaces are defined, which is the normal answer for a single firewall. The rule turned that into a custom error, so the host showed an unsupported rule while everything was fine. Observed on such a host: of 315 enabled items it was the only one unsupportedhistory: 1dor7dwith value type TEXT. Nothing reads that: a master exists to feed dependent items, which store their own values. Measured on one small firewall, four interfaces and 143 rules, the raw text came to 0.9 MiB in 64 minutes, about 20 MiB a day per hostCompatibility
The export declares format 7.0 rather than 7.4, so it imports into Zabbix 7.0 and every
later release. Every widget type it uses (gauge, honeycomb, item, svggraph) exists in 7.0.
Privileges
The README lists the ten privileges the monitoring user needs with their internal ids. Eight
are read only. It also says what the other two permit and how to do without them.
Licensing
Derived from
OPNsense by HTTP-JSONin this repository, MIT, Copyright (c) 2021 Zabbix. Thenotice travels with it, in the template description and in the README.
Maintained at https://github.com/Garfieldttt/opnsense-zabbix-template.