One pane of glass for your firewall fleet.

SNMP, sFlow, NetFlow/IPFIX, syslog, traps, and config-drift monitoring across every major firewall platform — and any SNMP device. Multi-user with roles and 2FA. Self-hosted. One container.

git clone https://github.com/xphox2/Firewall-Monitoring.git

Read the docs →

Multi-Vendor Firewall Support

Self-Hosted One Container

MIT Open Source License

Grounded in Operations

Built firewall-first.

General network monitoring tools give you a wall of generic OID graphs. Firewall-Mon is built specifically for firewalls.

Deep Vendor Intelligence

Native profiles across many firewall platforms read CPU, sessions, VPN tunnels, HA states, and SPU/ASIC metrics out-of-the-box. Zero MIB wrestling.

Config Drift with Risk Tags

Every config change is classified by risk—so a rule opened to ANY surfaces before it reaches production, not during your next audit.

NAT/CGNAT Traversal Probes

Remote site probes push metrics over outbound HTTPS. No inbound ports need to be exposed, keeping your branches completely locked down.

Interactive Preview

The Live Operations Dashboard

Experience the interface network security engineers use to monitor a distributed firewall fleet in real-time.

HQ-FortiGate-01 FortiGate 100F (v7.2.4)
Branch-OPNsense-02 OPNsense 23.7 (AMD64)
Colo-PaloAlto-01 PA-3410 (PAN-OS 10.2)
DC-CiscoASA-01 ASA 5516-X (ASA 9.18)
Edge-SonicWall-03 TZ470 (SonicOS 7.0)
Home-pfSense-01 pfSense Plus 23.05
Lab-Firewalla-01 Firewalla Gold Plus

HQ-FortiGate-01

Fortinet SNMP Profile

Poll interval: 30s Last poll: Just now

CPU LOAD

24%

↓ Normal load

ACTIVE SESSIONS

41,208

96% of threshold

VPN TUNNELS

12 / 12

All tunnels UP

HA CLUSTER

Active-Passive

Synced (Peer OK)

Real-time Interface Bandwidth

InboundOutbound

4 hours ago 3 hours ago 2 hours ago 1 hour ago Now

SNMP TRAP / SYSLOG INGEST

Process: fwmon-trap-receiver

[13:50:35] [INFO] Poller cycle complete for device HQ-FortiGate-01. All profiles loaded.

[13:50:32] [TRAP] FortiOS: OID .1.3.6.1.4.1.12356.101.2.0.402: HA state changed to active-passive. Cluster in sync.

[13:50:18] [INFO] Ingesting flow batch via X-Probe-Batch-ID: b48e2a14 (idempotent verification: OK)

Risk Classification

Risk-Classified Config Drift

Every config modification is normalized to a vendor-neutral model. Our security classification system parses each diff and flags security vulnerabilities.

CHANGE #14 CRITICAL

Allow-Internal-Admin rule opened to ANY

FortiOS config • 12 mins ago

CHANGE #12 MEDIUM

IPsec VPN Proposal DH Group weakened

PAN-OS config • 2 hours ago

CHANGE #09 INFO

Interface description modified

OPNsense config • 1 day ago

FortiOS Normalized Config Object: `rules/Allow-Internal-Admin`

Admin: j.doe via SSH

   edit "Allow-Internal-Admin"
       set srcintf "port1"
       set dstintf "internal"
 -     set srcaddr "HQ-Admin-Subnet"
 +     set srcaddr "all"
 -     set service "HTTPS" "SSH"
 +     set service "ANY"
       set action accept

CRITICAL SECURITY DRIFT CLASSIFICATION

Vulnerability Tagged: Firewall rule Allow-Internal-Admin modified to allow wildcard source address (all) and wildcard service protocol (ANY) targeting the internal zone.

Security Impact: This change exposes internal management resources directly to the public internet, bypassing authentication scoping. Violates baseline security control AUDIT-042.

High-Performance Traffic Monitoring

Multi-Protocol Flow Analytics

Ingest sFlow v5, NetFlow v5/v9, and IPFIX side by side — with content-based version dispatch, per-vendor template decoding, and denied-flow visibility from firewall events. Triage spikes on raw conversation-level detail.

Source Address	Destination Address	Port	Protocol	Flow Rate	Packets	Source
`10.100.4.120`	`54.210.19.43`	443	TCP (TLS)	1.2 MB/s	850/s	sFlow
`10.100.12.14`	`8.8.8.8`	53	UDP (DNS)	12 KB/s	40/s	NetFlow v9
`192.168.50.8`	`192.168.10.10`	445	TCP (SMB)	12.4 MB/s	9,200/s	IPFIX
`185.112.145.4`	`10.100.4.7`	23	TCP DENIED	0 B/s	3/s	IPFIX / NSEL
`10.200.5.88`	`185.112.145.4`	4444	TCP (Unencrypted)	140 KB/s	120/s	NetFlow v9
`10.100.4.15`	`142.250.72.110`	443	TCP (QUIC)	450 KB/s	320/s	sFlow

Access Control & Identity

Multi-user, with real roles.

Firewall-Mon is no longer a single-admin tool. Give your team scoped access, protect logins with two-factor authentication, and automate with API tokens — all enforced server-side.

Role-Based Access Control

Three roles — admin, operator, and viewer — enforced on every route, not just hidden in the UI. Operators run day-to-day changes; viewers get read-only; only admins touch users, credentials, and settings.

Two-Factor Authentication

Opt-in TOTP 2FA (RFC 6238) with single-use recovery codes and a guided enrollment wizard. Secrets are encrypted at rest; enabling or disabling 2FA revokes every live session instantly.

Scoped API Tokens

Issue read or read/write tokens for automation and service accounts. Token privileges follow the owner's current role, and disabling or deleting an account instantly revokes its tokens.

Enterprise Alerting & On-Call

Alerts that behave like a NOC.

Cut the noise and route the signal. Firewall-Mon groups incidents, escalates through tiered on-call steps, and baselines each device against its own history.

Incident Grouping

When a device goes offline, its CPU, interface, and VPN alerts attach to a single incident and stay muted — so you get one story and one recovery summary, not a pager storm.

Escalation Step Chains

Define tiered steps per policy — 5 min, 15 min, 60 min — each routed to exactly its own channels and recipients. Unacknowledged alerts climb the chain automatically.

Smart Thresholds

Clear-band hysteresis stops fire/recover flapping, and adaptive z-score baselining alerts when a metric strays from the device's own trailing-24h normal — not a static guess.

Flap Suppression

Alerts that fire and resolve repeatedly are tagged and silenced automatically, then resume on their own once the pattern settles — no manual muting, no missed real events.

Route it anywhere

Deliver to the channels your team already lives in. PagerDuty, Opsgenie, and Teams are stateful — recovery events resolve the incident they opened. Webhooks are HMAC-signed.

Email Slack Discord Webhook IRC PagerDuty Opsgenie Microsoft Teams

Executive reports track MTTA / MTTR and your noisiest alerts over a rolling 30 days.

Idempotent Ingestion Topology

Distributed Probe-Relay

Deploy local collectors at remote sites to sync telemetry behind CGNAT over outbound HTTPS, maintaining data parity on shaky uplinks.

fwmon-api (Collector) HQ Core • public IP

HTTPS POST (JWT Auth)

Firewall-Collector Remote site • Behind NAT

Telemetry Resiliency Safeguards

X-Probe-Batch-ID Idempotency

Every packet batch is stamped with a unique, UUID-based Header. Retries on packet drops are validated at rest, preventing duplicated log analysis or traffic spikes.

Schema Version Handshake

If a remote probe and the central collector undergo a schema mismatch, `fwmon-api` flags HTTP 426 Upgrade Required. The probe's internal disk queue holds, locking your logs until safe migration completes.

SHA-256 Secrets Encryption

Probe authentication keys and device passwords are hashed at rest using AES-256-GCM. Decryption verification is performed on start; pollers fail-fast immediately on key modification.

Capabilities

Production-grade monitoring.

Built for speed, compliance posture, and any firewall you run. Tap a card for the detail.

Multi-Vendor SNMP

Any SNMP-capable firewall, with native per-platform OID profiles.

Details →

Risk-Classified Config Diffs

Surface a rule opened to ANY before it ships.

Details →

Multi-Protocol Flow

sFlow, NetFlow v5/v9 & IPFIX — with denied-flow visibility. No PCAP.

Details →

Probe-Relay Architecture

Branch firewalls behind CGNAT, polled through one outbound HTTPS.

Details →

Single-Container Deploy

One `docker compose up -d`. PostgreSQL 16 bundled.

Details →

Audit-Grade Security

AES-256-GCM secrets, fail-fast keys, and an append-only audit log.

Details →

Roles & 2FA

RBAC, TOTP two-factor with recovery codes, and scoped API tokens.

Details →

Enterprise Alerting

Incident grouping, escalation chains, PagerDuty, Opsgenie & Teams.

Details →

Operations Reports

Email reports, redesigned.

Newly styled daily digests featuring Plus Jakarta Sans and modern dark gradients—crafted to be entirely compatible with Gmail and Outlook.

Daily Digest Summary (HQ-Fleet)

FIREWALL-MON

July 5, 2026

All Systems Operational

Daily Summary Report for your 8 monitored appliances.

100% Uptime

TRAFFIC & LOAD

Total Bytes Ingested: 1.42 TB
Avg CPU Load: 14.2%
Max Sessions: 51,408

ALERTS & EVENTS

Total Syslog Warnings: 14
Critical Config Drifts: 1
Mean Time to Acknowledge: 4.2 min

HIGH-PRIORITY SECURITY EVENT

CRITICAL

Rule Allow-Internal-Admin was modified on HQ-FortiGate-01 to allow source address all. Review changes immediately.

Review Config Diff

Audit-Ready Security

Continuously audited. Zero open.

Firewall-Mon is independently engineering-audited and re-checked in CI on every build. Encryption, access control, and audit logging are verified continuously — open findings stay at zero.

AES-256-GCM Secret Encryption

SNMP communities, SSH credentials, TOTP secrets, and every notification key — Slack, PagerDuty, Opsgenie, and webhooks — are encrypted at rest with AES-256-GCM.

M8 Fail-Fast Decryption Validation

Pollers and receivers crash immediately on initialization if database encryption credentials fail to decrypt secrets. Prevents stale polling states.

Append-Only Auditor Trail

All administrative actions, login events, and config backups generate immutable logs written directly to standard output.

0 OPEN

AUDIT POSTURE INVARIANT

VERIFIED SECURE

Quick Start

30 seconds to first poll.

Deploy the application locally or in production with a single command.

Pull the published image from Docker Hub and bring up the full stack — PostgreSQL 16 is bundled — with one command:

version: '3.8'
services:
  firewall-mon:
    image: xphox/firewall-mon:0.11 # Published to Docker Hub
    container_name: fwmon
    restart: unless-stopped
    ports:
      - "8080:8080"
      - "162:162/udp"   # SNMP Traps
      - "6343:6343/udp" # sFlow
      - "2055:2055/udp" # NetFlow v5/v9
      - "4739:4739/udp" # IPFIX
    environment:
      - JWT_SECRET=change-this-vibe-secret-value-123
      - ENCRYPTION_KEY=32-byte-hex-string-for-aes-keys
      - DB_AUTO_MIGRATE=true
    volumes:
      - fwmon_data:/var/lib/postgresql/data
      - fwmon_config:/etc/fwmon

volumes:
  fwmon_data:
  fwmon_config:

Clone and deploy: git clone https://github.com/xphox2/Firewall-Monitoring.git && cd Firewall-Monitoring && docker compose up -d

Run Firewall-Mon natively as a systemd daemon. Compile the single binary using Go 1.22+:

# Clone and build
git clone https://github.com/xphox2/Firewall-Monitoring.git
cd Firewall-Monitoring
make build

# Copy binary to system path
sudo cp bin/fwmon /usr/local/bin/

# Create systemd service
sudo cp deploy/fwmon.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now fwmon

Run the lightweight Firewall-Collector on remote servers behind branch firewalls to relay SNMP data to the main server. The image is hosted on Docker Hub: xphox/firewall-collector.

# Run remote collector container from Docker Hub
docker run -d \
  --name fw-collector \
  -e COLLECTOR_URL="https://your-main-collector:8080" \
  -e PROBE_KEY="sha256-probe-bearer-auth-token" \
  -e SYNC_INTERVAL=30s \
  xphox/firewall-collector:1.3

One pane of glass for your firewall fleet.

Built firewall-first.

Deep Vendor Intelligence

Config Drift with Risk Tags

NAT/CGNAT Traversal Probes

The Live Operations Dashboard

FIREWALL FLEET

HQ-FortiGate-01

Real-time Interface Bandwidth

Risk-Classified Config Drift

FortiOS Normalized Config Object: rules/Allow-Internal-Admin

PAN-OS Normalized Config Object: profiles/ipsec-vpn/hq-to-branch

OPNsense Normalized Config Object: interfaces/wan/description

Multi-Protocol Flow Analytics

Multi-user, with real roles.

Role-Based Access Control

Two-Factor Authentication

Scoped API Tokens

Alerts that behave like a NOC.

Incident Grouping

Escalation Step Chains

Smart Thresholds

Flap Suppression

Route it anywhere

Distributed Probe-Relay

Telemetry Resiliency Safeguards

X-Probe-Batch-ID Idempotency

Schema Version Handshake

SHA-256 Secrets Encryption

Production-grade monitoring.

Email reports, redesigned.

FIREWALL-MON

All Systems Operational

TRAFFIC & LOAD

ALERTS & EVENTS

Continuously audited. Zero open.

AES-256-GCM Secret Encryption

M8 Fail-Fast Decryption Validation

Append-Only Auditor Trail

AUDIT POSTURE INVARIANT

30 seconds to first poll.

FortiOS Normalized Config Object: `rules/Allow-Internal-Admin`

PAN-OS Normalized Config Object: `profiles/ipsec-vpn/hq-to-branch`

OPNsense Normalized Config Object: `interfaces/wan/description`