Short answer: free or open-source tools (pfSense, syslog, manual logging) can collect raw logs for Law 5651, but on their own they do not sign each day's log with an authorized authority's timestamp. The core of 5651 compliance is a timestamped signature that proves a log was not altered. Because free approaches leave the signature, audit trail and chain of responsibility open, a commercial solution usually lowers the true cost for most organizations.
This content is general information, not legal advice. For your organization's obligations, rely on Law No. 5651 and its related regulations and a qualified legal advisor.
What Free Approaches Cover and What They Miss
pfSense, OPNsense, plain syslog servers or manually kept records can collect internet-access logs. But Law 5651 does not merely expect you to "keep logs" — it expects the integrity and timing of those logs to be provable. The typical gaps of free tools are:
- Unsigned logs: A raw syslog record can be altered afterward, so in court or an audit the claim "this record looked like this on that day" is weak.
- No timestamp: Without an authorized authority's timestamp (for example TÜBİTAK Kamu SM), the date a log was created cannot be independently verified.
- Missing audit trail and reporting: Who viewed or changed which record and when, plus standard reports you can present on demand, are usually absent.
- Ownership and continuity: When the person who set it up leaves, patching, certificate renewal and tracking regulatory changes are left unattended.
- Support and accountability: There is no responsible party to call, and no one accountable for compliance, when something breaks.
In short, a free tool solves the "log collection" part of the equation; it does not solve the real obligation — a signed, timestamped and presentable archive.
Why Signing and Timestamping Are the Core of a Commercial Solution
SignLogger signs the logs it collects every day with an authorized certificate authority's (TÜBİTAK Kamu SM) timestamp and e-signature. This way each day's record is sealed on that day and becomes tamper-evident afterward. Kamu SM works with credits (kontör), and the signing process runs on those credits. Building a signing infrastructure from scratch in-house, managing certificates and reliably running automated daily signing is outside the scope of free tools. For details, see our Law 5651 log signing solution.
SignLogger is brand-independent: it works with any RADIUS-capable firewall, and because it runs on the organization's own infrastructure (VMware/Hyper-V), data never leaves the premises and stays on-prem. So you do not have to remove pfSense either — you can keep it as a source and hand the signing and archive layer to SignLogger.
An Honest Comparison
| Criterion | Free / pfSense / manual log | SignLogger (commercial) |
|---|---|---|
| Log collection | Yes | Yes |
| Daily signing | No (manual/ad hoc) | Automatic every day |
| Authorized timestamp | None | TÜBİTAK Kamu SM timestamp + e-signature |
| Integrity proof | Weak | Verifiable via signature |
| Audit reports | Limited/manual | Ready, presentable |
| Maintenance and updates | Your responsibility | Vendor-supported |
| Accountable contact | None | Yes |
| Visible cost | Low/zero | License/subscription |
| True cost (incl. risk) | Hidden labor + compliance risk | Predictable |
The free option is free as software licensing; but installation, ongoing maintenance, signing infrastructure and the risk of possible non-compliance make up the true cost. Penalty and obligation amounts vary by regulation.
Which Makes Sense for Whom?
- A one-person technical team in a non-critical setting: pfSense + syslog can work as a start, but the signing/archive gap must be accepted knowingly.
- Audited organizations offering guest/hotspot access with clear accountability: A signed and supported commercial solution lowers the risk cost. It can be managed from one place together with hotspot management.
Frequently Asked Questions
Can you achieve 5651 compliance with pfSense?
pfSense can collect internet-access logs, but on its own it does not sign each day's log with an authorized timestamp. Proving integrity and timing requires a signing and archive layer.
If I use a free tool, do I have to drop pfSense?
No. SignLogger is brand-independent; you can keep pfSense as a log source and hand the signing, timestamping and reporting layer to SignLogger.
Is keeping logs manually enough?
Manually kept records can be altered, so integrity proof is weak. To prove in an audit that a record was not changed, you need a signed and timestamped archive.
What is the real difference between commercial and free?
The difference is mainly signing, an authorized timestamp, audit reports, vendor support and clear accountability. A free tool collects logs; a commercial solution takes on provable compliance.
Does SignLogger send data to the cloud?
No. SignLogger runs on the organization's own infrastructure (VMware/Hyper-V); logs and the signed archive stay on-premises.
How does the timestamp work?
SignLogger signs the logs every day with a TÜBİTAK Kamu SM timestamp and e-signature. Kamu SM works with credits (kontör), and signing is carried out on those credits.