Configuring Snort Intrusion Prevention System (IPS) in pfSense CE firewall to send intrusion alerts to Kiwi Syslog Server Free Edition

Subject: Configuring Snort Intrusion Prevention System (IPS) in pfSense CE =
firewall to send intrusion alerts to Kiwi Syslog Server Free Edition

Good day from Singapore,

Author: Mr. Turritopsis Dohrnii Teo En Ming
Country: Singapore
Date of document: 22 Nov 2025 Saturday

Detailed steps are shown below.

Kiwi Syslog Server Free Edition
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D

Download and install Kiwi Syslog Server Free Edition as a Service. Don't in=
stall as an Application.

Open Kiwi Syslog Server Console

File > Setup > Inputs

Receive messages from below IP addresses:
192.168.1.1 <- pfSense firewall IP address

File > Setup > Inputs > UDP

Check Listen for UDP Syslog messages

UDP Port (1-65535): 514
Bind to address: Leave empty
Data encoding: System

File > Setup > Rules > Default > Actions > Log to file

Path and file name of log file:

D:\Syslog\SyslogCatchAll-%DateISO.txt

Log file format:

Kiwi format ISO yyyy-mm-dd (Tab delimited)

Allow firewall rules on Windows for UDP 514

Configure pfSense System Logging
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Login to your pfSense firewall.

Status > System Logs > Settings

Under Remote Logging Options section

Enable Remote Logging: Check Send log messages to remote syslog server

Source Address: LAN

IP Protocol: IPv4

Remote log servers: 192.168.1.101:514

Rermote Syslog Contents: Check Everything

Click Save.

Enable Snort > Syslog Output
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D

Services > Snort

For WAN interface, click the pencil (edit) icon.

Under WAN Settings

Under Alert Settings

Send Alerts to System Log: Check Snort will send Alerts to the firewall's s=
ystem log.

System Log Facility: LOG_AUTH

System Log Priority: LOG_ALERT

Click Save.

Windows Firewall Rule for Kiwi Syslog Server
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

On the Kiwi server:

Create inbound rule:

Protocol: UDP

Port: 514

Action: Allow

Otherwise pfSense firewall logs will never reach it.

Reboot pfSense firewall.

I have completed all of the above steps on 20 Nov 2025 Thursday at 10.40 PM=
 Singapore Time.

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Singapore
22 Nov 2025 Saturday 11.28 am Singapore Time