ntopng on pfSense & OPNsense
ntopng is a high-speed network traffic analyzer — live flows, top talkers, per-host and per-application breakdowns, geolocation, and historical timeseries, all from a web dashboard running directly on your firewall. Where syslog tells you what a firewall did, ntopng shows you what the traffic is. This guide installs and configures ntopng on both platforms, noting where their approaches diverge sharply: OPNsense has a clean supported plugin, while pfSense's built-in package is best replaced with the upstream build.
ntopng sniffs packets on the interfaces you point it at and builds a real-time picture of every flow. It needs a companion Redis instance for its key-value store, and it writes timeseries data to disk. On a firewall it most commonly watches the LAN and WAN interfaces to see traffic in both directions.
| Component | Role |
|---|---|
| ntopng | Captures and analyzes traffic; serves the web dashboard (default port 3000) |
| Redis | Required dependency — backing store for ntopng's state and counters |
| nProbe (optional) | Lightweight flow exporter, for the "offload to a bigger box" model in section 07 |
OPNsense ships a maintained ntopng plugin, so this is the smoother of the two. Redis is a hard dependency and installs as its own plugin. Do Redis first.
| Step | Action |
|---|---|
| 1 | System → Firmware → Plugins, install os-redis |
| 2 | Services → Redis, tick Enable Redis, click Apply |
| 3 | Back in Plugins, install os-ntopng |
| 4 | Log out and back in so the new Services → ntopng menu appears |
os-redis service is the one prerequisite that makes everything else work.Go to Services → ntopng → General, turn on Advanced mode, enable the service, choose interfaces, and set the admin password.
| Field | Value |
|---|---|
| Enable advanced mode | Yes (exposes the interface selector) |
| Enable ntopng | Yes |
| Interfaces | Select LAN (and WAN if you want both directions) |
| HTTP port | 3000 (default) |
| Admin password | Set a strong one — it's the dashboard login |
Click Save, then confirm under System → Diagnostics → Services that ntopng is running. Browse to http://your-firewall-ip:3000 and log in as admin with the password you set; you'll be prompted to change it on first login.
pfSense lists an ntopng package in System → Package Manager, configured under Diagnostics → ntopng Settings (enable service, set admin password, pick the LAN interface). It's the quickest path and fine for a quick look — but it has a long track record of problems.
| Known issue | Effect |
|---|---|
| Stale version | The packaged build lags far behind upstream ntopng |
| Config wiped on restart | On some versions a service restart loses interface renames, alert endpoints, etc. |
| Instability | Reports of the service repeatedly restarting or running slowly |
The reliable route on pfSense is the official ntop.org FreeBSD build, installed from the shell. SSH in or use the console and choose option 8 (Shell). First remove any GUI-installed ntopng so the package manager doesn't try to pull out system components.
pkg add bootstrap command is on packages.ntop.org/FreeBSD — copy the one for your edition. Installing a mismatched ABI is the usual cause of failed installs.Copy the sample config, then enable both services. ntopng depends on Redis, so Redis must come up first.
Browse to https://your-firewall-ip:3000 and log in (default admin / admin on a fresh upstream install — change it immediately).
Running full ntopng analysis and on-disk timeseries directly on a busy firewall competes with the firewall's real job and can exhaust storage. ntop's recommended pattern for larger networks splits the work.
| Where | Runs |
|---|---|
| On the firewall | nProbe — lightweight, low-resource flow exporter, minimal disk use |
| On a LAN host / VM | ntopng — receives the exported flows, does the heavy analysis and storage |
nProbe exists as a plugin on OPNsense (os-nprobe) and from the same ntop FreeBSD repo on pfSense. The firewall stays lean; the analytics box can be sized for retention. This is the right architecture once a single firewall-hosted ntopng starts struggling.
Once traffic is flowing, the ntopng UI gives you live and historical visibility. A few starting points:
| View | What it shows |
|---|---|
| Dashboard | Live top talkers, top applications, throughput at a glance |
| Hosts | Per-host traffic, contacted peers, protocols, and risk indicators |
| Flows | Active flows in real time — source, dest, protocol, bytes |
| Interfaces | Per-interface stats; switch between the interfaces you enabled |
| Alerts | Triggered behavioural and threshold alerts |
| Item / Symptom | Value / Fix |
|---|---|
| Web UI | http(s)://firewall-ip:3000 |
| Dependency | Redis must be installed and running first |
| OPNsense install | Plugins: os-redis + os-ntopng; configure under Services → ntopng |
| pfSense (reliable) | Upstream ntop.org FreeBSD build via shell + Shellcmd for boot |
| Service won't start | Check Redis is up; check redis.conf dir /var/db/redis/ |
| No interfaces listed | Run ntopng -h; set them in config (pfSense) or in ntopng UI (OPNsense) |
| Disk filling up | Limit retained timeseries, or move analysis off-box via nProbe |
| Config lost on restart | Symptom of the buggy pfSense GUI package — switch to the upstream build |