opnsense_get_firewall_log
Retrieve and filter recent firewall log entries by verdict, interface, address, port, or protocol to find why traffic was blocked or allowed.
Instructions
Read recent firewall log entries and filter them by verdict, interface, address, port or protocol.
This is the primary tool for "why was this traffic blocked". Two caveats that change how you should read the results:
Only rules with logging enabled produce entries. Traffic silently dropped by the default deny rule appears as a block against the default rule label; traffic allowed by a rule with logging off produces nothing at all. Absence of a log entry is therefore not evidence that traffic was blocked.
Filtering is applied locally over the most recent entries this call retrieved, so a narrow filter over a busy firewall may return nothing simply because the matching packets are older than the window. Raise 'limit' before concluding there is no traffic.
Args: params (FirewallLogInput): Validated input containing: - action (str): "pass", "block" or "rdr" (default: "") - interface (str): Device name filter (default: "") - address (str): Substring match on source or destination (default: "") - port (str): Exact source or destination port (default: "") - protocol (str): Protocol name filter (default: "") - limit (int): Max entries to return, 1-200 (default: 25) - offset (int): Entries to skip (default: 0) - response_format (ResponseFormat): 'markdown' or 'json'
Returns: str: Markdown table, or JSON with this schema: { "total": int, # matching entries in the retrieved window "count": int, "offset": int, "has_more": bool, "next_offset": int|null, "window_size": int, # raw entries examined "entries": [ {"timestamp": str, "action": str, "interface": str, "dir": str, "protoname": str, "src": str, "srcport": str, "dst": str, "dstport": str, "label": str, "rid": str} ] }
Examples: - Use when: "Why can't the IOT camera reach the internet?" -> address="192.168.30.57", action="block" - Use when: "What is being blocked on WAN right now?" -> interface="pppoe0", action="block" - Don't use when: You want established connections (use opnsense_query_firewall_states)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |