Link a firewall

Requirements

• pfSense CE 2.7 or later, or pfSense Plus 23.09 or later. OPNsense 24.1 or later works in beta (backups and analysis work; some live status, such as VPN users, is partial).
• The firewall can reach your Revo address over HTTPS (port 443) outbound.
• Admin access to the firewall's web GUI (Diagnostics → Command Prompt) or a root shell (SSH or console, option 8).

Nothing has to be opened inbound.

Link it

1. Open the customer, then Firewalls → Add firewall (in all-customers mode, choose the customer in the dialog). Optionally give it a name; otherwise its hostname is used.
2. Choose Create install command. Revo creates a single-use link code, valid for 7 days, and shows the command.
3. On the firewall, open Diagnostics → Command Prompt, paste the command into Execute Shell Command and run it (or paste it into a root shell). It takes about 20 seconds.
4. Keep the dialog open: it changes to Firewall linked when the first report arrives. The configuration backup and the security analysis follow within a minute.

The command downloads the installer from your Revo server, which then:

• downloads the collector and checks its signature against Revo's signing key (it stops if the check fails);
• installs it in /usr/local/revosecure, generates the firewall's own signing key there (the private key never leaves the firewall) and links it with the code;
• adds a cron entry that runs the collector every five minutes. It doesn't change the firewall's configuration.

The dialog also shows the installer's SHA-256 if you want to check it before running it.

What the collector does and doesn't do

• It reads status (gateways, interfaces, VPNs, services, resources, update availability, failed logins) using the firewall's own functions and standard commands, and the configuration file.
• It sends a status report every five minutes and the configuration file whenever it changes.
• It never opens a port, changes the configuration, or runs anything Revo sends, except an update of itself that is signed by Revo (it keeps its current version if the signature doesn't check out).
• Status reports never contain secrets (password hashes, keys, pre-shared keys). The configuration file does: see Config backups for how it's protected, and for installing without full backups.

Check it

On the firewall:

php /usr/local/revosecure/collector.php status

shows whether it's linked, when it last reported and the last error, if any. In Revo, the firewall's header shows when it last reported; after 15 minutes without a report it's shown offline and an alert is raised.

Uninstall

On the firewall:

sh /usr/local/revosecure/uninstall.sh

removes the cron entry and /usr/local/revosecure. The firewall then shows as uninstalled in Revo, with its history kept. Removing the firewall in Revo (Settings tab) refuses its reports from then on, and the collector turns itself off; run the uninstall command to remove its files too.

Pause monitoring (Settings tab) is different: the collector keeps running, and Revo ignores its reports and raises no alerts until you turn monitoring back on.

Troubleshooting