pfSense » pfSense Plus

The required OS code has been merged.

pflow configuration is done through `pflowctl`. Use `pflowctl -c` to create a flow exporter. List them with `pflowctl -l`.
Flows can be configured with `pflowctl -s pflow0 src 192.168.1.1:1234 dst 10.0.0.1:2055 proto 10 domain 42`. This sets the source to IP 192.168.1.1 port 1234, the destination to 10.0.0.1 port 2055, the protocol version to 10 and the observation domain to 42.

Flow exporters can be removed again with `pflowctl -d pflow0`.

pf will only export flow information for states that are created by rules that have the 'pflow' tracking option set. e.g. "pass in from 192.0.2.2 keep state (pflow)"
That option can be set for all rules with "set state-defaults pflow".

Things to keep in mind when testing.

When inactive (disabled or not yet applied):

: kldstat | grep -i pflow
: pflowctl -l
pflowctl: pflow.ko is not loaded.
: pfctl -vvsr | grep -c pflow
0
: grep -c pflow /tmp/rules.debug
0

When active:

: kldstat | grep -i pflow
18    1 0xffffffff84622000     53e8 pflow.ko
: pflowctl -l
pflow0: version 10 domain 1 dst 172.21.32.3:2055
: pfctl -vvsr | grep -c pflow
39
: grep -c pflow /tmp/rule
rules.debug   rules.limits  
: grep -c pflow /tmp/rules.debug 
16

The specific values will vary based on the rules on the system.

Be sure to test with it enabled/disabled globally and per-exporter and make sure that the state is expected at each step.

Test with pflow on rules by default and off by default + explicitly configured on rules.