Can pfSense be hardenized to be PCI compliant?

[AR 0]

Hi everyone.

Is it possible to hardenize a pfSense to be PCI compliant? And also retain all settings when upgrading the system?

Any info/guidance would be much appreciated.

[rcoleman-netgate]

@AR-0 pfSense is inaccessible from the internet in it's default state... I'm not sure how much more "hardenized" it can get from that point.

[AR 0]

@rcoleman-netgate Thank you

[stephenw10]

We see quite a few queries from people who are using one of the external PCI testing services and failing because they are testing it wrong. Most of those services specify you must not block the IP range they are testing from using 'active' detection methods. In pfSense that's Snort or Suricata. It does not mean you must open the firewall WAN to their range which would result in an invalid test. Any attacker on the internet would not be passed on the WAN by default!

[AR 0]

@stephenw10 Thank you for the information

[johnpoz]

@stephenw10 said in Can pfSense be hardenized to be PCI compliant?:

It does not mean you must open the firewall WAN to their range which would result in an invalid test.

QFT... I have seen multiple threads with just that as the problem..

[rcoleman-netgate]

@johnpoz said in Can pfSense be hardenized to be PCI compliant?:

QFT

Quantum field theory?

[johnpoz]

@rcoleman-netgate haha - yeah I guess it could stand for that as well ;)

quoted for truth

[rcoleman-netgate]

@johnpoz said in Can pfSense be hardenized to be PCI compliant?:

quoted for truth

TIL. Thank you

[johnpoz]

@rcoleman-netgate said in Can pfSense be hardenized to be PCI compliant?:

TIL

Tech Information Library ;) hehehehe

[AR 0]

@johnpoz Thanks!