GUIDE — 2026-08-06

pfSense syslog to Mac: complete setup

If you run pfSense or OPNsense, the default log rotation is aggressive and the built-in web UI does not let you search deeply into history. Forwarding syslog to a macOS receiver gives you searchable long-term storage and real-time alerts on your own hardware, no cloud subscription.

Why do this

pfSense has excellent logs. It also has excellent log churn. The default configuration keeps only 500 KB or so per log stream before rotating; on a home firewall with any real activity, that means a few hours of filter log at most. Sending everything to a Mac lets you keep months of history and search it in a second.

This guide works for both pfSense CE / Plus and OPNsense. Menu paths differ slightly and are noted where relevant.

What you need

• pfSense 2.7+ or OPNsense 24+
• A Mac at a stable IP
• SyslogWatch on the Mac (free tier is enough for a home firewall)

Step 1 — Reserve an IP for your Mac

In pfSense:

1. Services → DHCP Server → your LAN interface
2. Scroll to DHCP Static Mappings → Add
3. Enter the Mac's MAC address (System Settings → Network → Details → Hardware) and pick an IP outside the DHCP range
4. Save and Apply Changes

On the Mac, reconnect the network so it picks up the reserved address. Verify with ifconfig en0 | grep inet.

Step 2 — Install SyslogWatch

Mac App Store. Launch it — the app listens on UDP + TCP 1514 by default.

If your Mac's firewall is on, when SyslogWatch first tries to open the port macOS will show a dialog. Click Allow. If you missed it, go to System Settings → Network → Firewall → Options → find SyslogWatch → set to Allow incoming connections.

Step 3 — Configure pfSense to forward

pfSense (CE and Plus)

1. Status → System Logs → Settings
2. Scroll to Remote Logging Options
3. Check Enable Remote Logging
4. Source Address: leave as Default
5. IP Protocol: IPv4 (unless you have IPv6 preference)
6. Remote log servers: YOUR-MAC-IP:1514
7. Remote Syslog Contents: check the categories you want. For a homelab starting point:
   • Firewall events (this is where blocked packets show up)
   • DHCP service events
   • VPN (OpenVPN, IPsec, WireGuard)
   • System events
   Everything is a lot. You can always add more later.
8. Save

OPNsense

1. System → Settings → Logging / targets → click + to add a target
2. Enabled: check
3. Transport: UDP4 or TCP4
4. Applications: leave empty to capture all, or select specific ones
5. Levels: usually leave all except debug
6. Facilities: leave empty (all)
7. Hostname: YOUR-MAC-IP
8. Port: 1514
9. Save and Apply

Step 4 — Verify

Trigger a small event: on the Mac, try to SSH to some blocked port on the pfSense box. Within a second or two, a filter block message should appear in SyslogWatch showing the source, destination, and pf rule id.

If nothing arrives, check with tcpdump on the Mac:

sudo tcpdump -i any -n port 1514

You should see UDP packets from your pfSense IP.

Step 5 — Filters that pay for themselves

pfSense produces a lot of log lines. Use filters aggressively.

• filterlog — only filter log entries (blocked and passed packets)
• block in combination with filterlog — only blocks
• dhcpd — DHCP requests, offers, and IP conflicts
• openvpn or wg or ipsec — VPN events
• suricata — IDS/IPS alerts (if you run it)
• login — SSH and web UI login attempts
• ntpd — clock adjustments (useful when you have odd timestamp behavior)

Step 6 — Alerts that actually matter

With SyslogWatch Pro:

• Match "Failed password" AND source is pfSense → sound alert (brute force attempt on SSH)
• Match "webConfigurator: Successful login" from non-LAN source → email (someone logged into the firewall from outside)
• Match "DHCPACK" bursts from a single MAC → email (device flapping)
• Match "gateway is down" → sound + email

Reading pf filter log entries

A typical filter log line looks like:

filterlog: 21,,,1000000103,igb1,match,block,in,4,0x0,,64,12345,0,DF,6,tcp,60,203.0.113.5,192.168.1.1,54321,22,0,S,3213125467,,29200,,mss;sackOK;TS;nop;wscale

The comma-separated fields tell you: rule id 1000000103, interface igb1, action block, direction in, IPv4, protocol TCP, source 203.0.113.5, destination 192.168.1.1, port 22 (SSH), TCP flag S (SYN). Someone tried to open an SSH session from a random internet host and pf blocked it.

Common surprises

Timestamp drift: pfSense uses BSD-style RFC 3164 timestamps by default. SyslogWatch parses both RFC 3164 and RFC 5424; if your timestamps look odd, check pfSense System → General Setup → Timezone.

UDP packet loss: On a very busy firewall, UDP syslog can drop under sustained load. Switch to TCP transport (both pfSense and SyslogWatch support it) if you notice missing events. TCP is slightly more overhead but reliable.

Firewall blocking its own syslog: If you have a pf rule that blocks all outbound to LAN devices, add an explicit pass rule from the firewall to your Mac on port 1514.

Next steps

Once pfSense is streaming, add your other network gear to the same receiver:

• UniFi → Mac
• Synology → Mac

Get SyslogWatch on the Mac App Store — free tier, no signup.