@bmeeks said in pfSense BLOCKS this kind of traffic, or just monitors it?:
@uxm said in pfSense BLOCKS this kind of traffic, or just monitors it?:
@bmeeks said in pfSense BLOCKS this kind of traffic, or just monitors it?:
@uxm said in pfSense BLOCKS this kind of traffic, or just monitors it?:
@bmeeks The "block Offenders" setting was unchecked. So I changed it to "Legacy Mode" and also checked "Block On DROP Only".
But, the ET Compromise will not be blocked right?
If you enabled the "Block on DROP Only" option and did not also use SID MGMT to set rules to DROP, then nothing will get blocked. It sounds like you are really new to using an IDS/IPS. I suggest you do some research on Google and learn how this technology works first.
Your questions about the IDS/IPS package and your other posts in this thread about security for RDP indicate you may be very new to network security. Your setup as you have currently described it is very much not as secure as it could and should be.
Yes, its a very new field for me. I try my best learning more (though I dont have so much time) Thanks @bmeeks
Nothing wrong with being new to a field. All of us were also, at one time, new to this field. Spend some time searching for and browsing related links on Google to learn some more about the technolgoy.
The very first thing to learn about is what are VPNs (virtual private networks) and how they are used to enhance security for remote connectivity options such as Remote Desktop on Windows and other scenarios where you need remote access back into your LAN. You really, really need to be using a VPN for any kind of remote access from outside back into your local network (your LAN). Pretty much nothing else (such as obscure port forwards) is as secure as a VPN. pfSense gives you everything you need, out of the box, to configure a secure remote access setup.
Then read up on stateful inspection firewalls and how they operate. pfSense is a stateful inspection firewall. Then learn about the default-deny rule on the pfSense out-of-the-box WAN configuration and how that pretty much stops any unsolicited connectivity into your network. Only when you enable port forwards or otherwise monkey with that default deny rule do you open yourself up to external attack.
Only turn on the IDS/IPS package much later after you gain experience in this area. And even then, at first you should always run an IDS/IPS in detect-only mode for perhaps as long as a month to see what traffic patterns are "normal" for your network and to see which rules are being triggered. It is likely a number of triggered rules would actually be false positives and would need to be "tuned out" as you refined your IDS/IPS rule set. If you just install a tool such as Suricata or Snort and enable blocking immediately, you can expect to pretty much have all of your web browsing broken by false positve rules triggering.
I will follow your advices. Thank you so much. I really need to clear my viewing on that one.
Update : I have just setup my OpenVPN Server configuration and created my VPN user. Also exported the OpenVPN client for Android (my phone) and Windows (my work PC) and everything works super. Thanks! :)
PS : one problem though.. At work, I have two Internet Connections. The "production" connection (with ASA Firewall configured from the company that supports us) and one "off production, backup" internet connection. I use the "off production" connection. I connect but there are many disconnections/connections while I am connected... every 5-10 seconds..
