OPNsense

This guide covers firewalls and appliances running OPNsense.

Create a dedicated backup account

1. Go to System > Access > Users and add a user named netwatch-backup with a strong password.
2. Grant the account shell access so QUARK can log in over SSH: assign the System: Shell account access privilege, either directly on the user or through a group under System > Access > Groups.
3. The full configuration is only readable with elevated rights. Add the user to the admins group, and under System > Settings > Administration set the Sudo option so administrators with shell access are allowed to elevate.

Enable SSH access

Under System > Settings > Administration, in the Secure Shell section:

1. Check Enable Secure Shell.
2. Check Permit password login if the account authenticates with a password, or install the collector's SSH public key on the account instead.
3. Select the Listen Interfaces the collector will reach the firewall on.

OPNsense does not automatically open the SSH port on non-LAN interfaces. Add a firewall rule that permits TCP port 22 from the QUARK collector's IP address only.

Platform notes

• OPNsense stores its entire configuration in a single XML file, so the backup captures users, certificates, and plugin settings in one document.
• Permit root user login is not required as long as the backup account can elevate with sudo.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.