Firewalls overview
What Revo monitors on pfSense and OPNsense firewalls, how RevoSecure scores them and what alerts it raises.
Updated
Firewalls is a central console for your customers' pfSense (and, in beta, OPNsense) firewalls: status, updates, VPNs, internet exposure, a security score and automatic configuration backups, for every customer in one list.
It works through the firewall collector, a small script that runs on the firewall every five minutes and sends what it reads to Revo over HTTPS. Nothing connects in to the firewall: no port forward, no API key, no VPN, and Revo never logs in to it. See Link a firewall.
What you see
| Tab | What it shows |
|---|---|
| Overview | Version and update status, CPU, memory, disk and state table, gateways with latency and loss, interfaces, recent alerts, a 24-hour to 30-day performance chart |
| Security | Open findings with how to fix them, and every check that ran (passed or failed) |
| Exposure | What the internet can reach: port forwards and pass rules on internet-facing interfaces, split into open to anyone and restricted to specific sources |
| Rules & NAT | Firewall rules per interface in evaluation order, port forwards and aliases, with who last changed each rule |
| VPN | Connected OpenVPN users, IPsec tunnels with their state and crypto, OpenVPN instances, WireGuard peers and their last handshake |
| Users & certificates | Local users and their access, certificates and CAs with what uses them and when they expire, management access settings, services and packages |
| Config backups | Every configuration version with who changed what, a diff, and downloads (Config backups) |
| Manage | Open the firewall's own GUI and SSH console through your management relay (Remote management) |
| Settings | Name, notes, pause monitoring, move to another customer, remove |
The portfolio list (all customers) puts the firewalls that need attention first: offline ones, then critical and high findings.
Security checks
Each firewall gets a score (0–100) and grade from its open findings, with the same severity weights as the customer score; a critical finding caps it at 55 and a high one at 79. The findings are ordinary RevoSecure findings: they appear in Findings and the action plan, count towards the customer's score and appear in reports. They resolve themselves when the configuration no longer has the problem.
| Area | Checks |
|---|---|
| Exposure | Allow-all rules on WAN; web GUI or SSH reachable from the internet; high-risk services (RDP, SMB, databases, Telnet, VNC and others) forwarded or allowed from anywhere |
| Access | The factory admin/root account still using the default password (checked against its bcrypt hash; the password itself is never seen. Other hash formats, such as OPNsense's Argon2id, leave the check inconclusive); GUI over HTTP; SSH password logins; GUI hardening (DNS rebinding check, referer check, HSTS); unprotected console |
| VPN | IPsec with weak encryption, integrity or DH groups, IKEv1 aggressive mode with a pre-shared key, short PSKs; OpenVPN with weak ciphers or digests, no tls-auth/tls-crypt key, or compression |
| Certificates | Expired or soon-expiring certificates in use, weak keys or signatures, a self-signed GUI certificate |
| Services | UPnP/NAT-PMP on, SNMP with a default community, DNSSEC off in the resolver, no remote logging, blocked traffic not logged, WAN not blocking private and bogon sources |
| Updates | The firewall runs below its target version; package updates available; a version that no longer receives fixes |
Target versions
Revo decides whether a firewall is up to date by comparing the version it runs with a target version for its product (pfSense CE, pfSense Plus or OPNsense). The firewall's overview shows the result, for example "Running 2.9.0 · Up to date (target 2.9.0)" or "Update to pfSense CE 2.9.0".
- By default the target is the latest release: the newest version any of your firewalls of that product offers in its update check or already runs.
- Owners and admins can approve a version under Target versions at the bottom of the Firewalls page: Approve the latest release, or Pin a version such as 2.8.1 while you test a new release. With an approved target, firewalls on it are up to date, and a newer release shows as "2.9.1 is out, not approved yet" instead of raising findings. Follow latest goes back to the default. The target applies to the whole workspace.
- Only firewalls below their target get an update finding. If a firewall is behind but its own update check doesn't offer the target, the finding says so: check the update branch under System → Update → Update Settings on the firewall.
- While a firewall's update check fails, its update status shows as unknown and nothing changes until a check succeeds.
Approving a target doesn't install anything on the firewall. Upgrade from System → Update during a maintenance window, after checking the configuration backup.
Alerts
Firewall alerts appear in Alerts with the source Firewall, and high and critical ones notify your alert recipients like any other security event (see Notifications).
| Alert | When |
|---|---|
| Stopped reporting (high) | No report for 15 minutes; resolved by the next report |
| Gateway down | A gateway's monitor stops responding (high when it's the default gateway or every gateway is down) |
| VPN tunnel down | A configured IPsec tunnel or OpenVPN client isn't connected |
| Port opened to the internet (high) | A configuration change opens a new port to any source |
| Failed logins | 10 or more failed GUI or SSH logins between two reports, with the source addresses |
| CARP failover | A high-availability address changes role |
| Disk, state table or memory | Disk 90%+, state table 80%+, memory 90%+ |
Configuration changes themselves are recorded in Change history (who changed what, and a link to the diff), not raised as alerts.
Permissions
Viewing firewalls needs View agents/devices (technicians, analysts and up); linking, renaming, pausing, moving and removing need Manage agents. Approving target versions and downloading a restorable (unredacted) configuration need an owner or admin. The customer portal never shows firewall configurations, only the findings you choose to share.