@BBcan17:
Hi Bill,
I have been going thru the Snort rules and disabling/Enabling the ones to suit my network and I came across a few ideas.
My replies are below. Thank you for the ideas. Unfortunately, one of them I really don't think can ever work; however, the other two are possible.
@BBcan17:
Ability to create Multiple Snort Interfaces. Only one Interface per NIC would be online, the others could be offline. It could also allow testing of Rulesets without compromising the Primary Interface settings.
I think the template idea suggested by user Supermule is a way to accomplish this. It sounds like what you are really talking about is a way to quickly switch on or off a group of rules for an interface.
@BBcan17:
The ability to Copy the "Snort Interface" to another pfSense Box. This would allow managing rulesets for several boxes with similar setups.
This feature is available now thanks to user Marcelloc here on the forum. He contributed the XML RPC sync part of Snort. It is currently marked experimental, but in fact works quite well. You can sync the Snort configuration across multiple boxes. The one requirement for now is they must have the same NIC hardware so the real interface names match. For example, em0, em1, etc. I think the users currently making use of this sync feature are doing so on groups of virtual machines where the virtual hardware is identical.
The template idea I mentioned above might also fill this need when implemented. Maybe I can incorporate something into the template code that would handle automatically the change in real interface names.
@BBcan17:
In Global Settings, the option for "Remove Blocked Host Interval" could be set separately in each category so that we can better control how long the Block should last for.
This one can't be done because it's not Snort that does the clearing. Remember Snort is simply stuffing IP addresses into a pf table. The table is called snort2c. Once an IP is inserted there, it's the responsibility of the packet filter engine code to keep up with it. The pf engine keeps a counter on "activity" by IP address. In other words, it monitors the connections. There is a cron job that the Snort package creates that calls the expiretable utility once per the interval you set (1 hr, 1 day, etc.). The expiretable utility is given the pf table to clear and how many seconds of "no activity" must be in the stats for an entry to be removed. The pf table has no way to store additional data about the IP address (such as what rule fired it, etc.). This means Snort can't offer selective clear times based on rule origin.
Bill
