Monitor OPNsense · pfSense with an agent that reports to one console.
FreeBSD 13 and 14, amd64. The same agent on the firewall itself: services, the log, disk, memory, the WAN address and every custom check. BE AI investigates when something fails; a person approves the fix.
install
One line, from the company's install page.
Run in the firewall's shell. It fetches the signed binary, verifies the checksum, installs the service and connects. Run it again any time; it never overwrites the machine's identity.
fetch -o - https://hub.[yourdomain]/install/inst_…/freebsd.sh | sh
Outbound 443 to the hub only. No inbound rule, no VPN, no SNMP community.
what the agent watches on OPNsense · pfSense
Servicesunbound, dhcpd, openvpn, wireguard, suricata, haproxy: enabled services whose status fails are listed, restart proposed by BE AI, approved by you.
LogError-level lines from /var/log/messages, read on demand by BE AI with a cap on size.
ReachabilityPing and TCP checks from the firewall outward: the VPN peer, the ISP gateway, head office, a cloud service.
Disk, memory, CPUA firewall with a full disk stops logging; a firewall with no memory drops states. Both are caught before they matter.
OfflineCritical after the grace period. BE AI compares with the site's other machines to say whether the site or the box is down.
UpdatesThe agent updates itself from signed releases. Firmware upgrades are yours; the install line brings the agent back if the upgrade removed it.
questions
Before you put it on OPNsense.
Does it change firewall rules?
No. There is no tool for it. Rules stay in the OPNsense or pfSense interface. BE AI can restart a service or run a bounded command, only after you approve.
What about the package system and upgrades?
The agent lives under /usr/local with its own rc.d script. Most upgrades leave it alone; if one removes it, re-run the install line. The machine identity is kept, so history continues.
Which versions?
OPNsense 24 and later, pfSense CE 2.7 and Plus 24 and later, on FreeBSD 13 or 14 amd64. [Confirm the list before publishing.]
Resource use?
About 8 MB on disk and roughly 20 to 30 MB of memory. One outbound connection. Heartbeats are under 1.5 KB.
Put BE Hub on ten machines this week.
A pilot takes an afternoon: one install link, your own approvals, your own data. Uninstall the agent and you are out.