Crowdsec finally comming to pfSense

buggz

Perfect, seems to work, will know in a few more days.

cat /usr/local/etc/crowdsec/hub/parsers/s02-enrich/crowdsecurity/whitelists.yaml
name: crowdsecurity/whitelists
description: "Whitelist events from private ipv4 addresses"
whitelist:
  reason: "private ipv4/ipv6 ip/ranges"
  ip:
    - "127.0.0.1"
    - "::1"
  cidr:
    - "192.168.0.0/16"
    - "10.0.0.0/8"
    - "172.16.0.0/12"
  # expression:
  #   - "'foo.com' in evt.Meta.source_ip.reverse"

Antibiotic

Hi, like me understood , the profit of use Crowdsec if pfSense have opened ports on WAN? no any opened , no any profit. If using pfBlockerNG will Crowdsec only duplicate functionality?
Crowdsec is working with a Snort? Have a read working with Suricata, what about Snort?

buggz

I don't know if CrowdSec duplicates pfBlockerNG.

I use both pfBlockerNG development and Snort.
Seems to be working good for me so far...

@Antibiotic said in Crowdsec finally comming to pfSense:

If using pfBlockerNG will Crowdsec only duplicate functionality?
Crowdsec is working with a Snort? Have a read working with Suricata, what about Snort?

Antibiotic

@buggz Are you keep opened any ports on WAN?

Antibiotic

@mmetc Any news, regarding the official including of package in pfSense repo?

SteveITS

@Antibiotic If you have no open ports on WAN then you are only able to block outbound connections.

Surely some pfBlocker lists will include malicious IPs, depending on the list(s) chosen. It is a question of when the lists update.

re: including it, I skimmed the install and a few things stood out, for instance that the config isn't able to be restored from pfSense backup, it is only configurable via command line not web GUI, and is not compatible with RAM disk for /var. I would think some or all of those are big enough issues for Netgate to not include it yet, but obviously I do not speak for either.

Antibiotic

@SteveITS Ok, thanks. But any profit to use /var in RAM, if pfSense instal on nvrme?

SteveITS

@Antibiotic said in Crowdsec finally comming to pfSense:

But any profit to use /var in RAM, if pfSense instal on nvrme?

Not that much, no. It can save disk writes if you do a lot of logging. Our clients often have eMMC drives and we disable a lot of logging.

Antibiotic

@SteveITS Can you please share, what kind of logs you disabled? and where, could be also will switch OFF!

SteveITS

@Antibiotic

uncheck "Log packets matched from the default block rules in the ruleset"
uncheck "Log packets blocked by 'Block Bogon Networks' rules"
uncheck "Log packets blocked by 'Block Private Networks' rules"
set "Log Compression" = None on all devices with ZFS (off by default but on if you restore an old config to new unit), or devices with eMMC
Suricata uncheck "Enable HTTP Log"

re: default block rules, we turn those on temporarily if we're debugging something.

Antibiotic

@SteveITS Thank you , one question if use Crowdsec which one reading different logs, this unchecks will not OFF some important data logs for Crowdsec readings?

SteveITS

@Antibiotic I have not used the Crowdsec plugin.

Dobby_

@SteveITS said in Crowdsec finally comming to pfSense:

@Antibiotic I have not used the Crowdsec plugin.

Hey Steve do you know where to find "Crowdsec" for installing it on pfSense?
I havw done a pkg info and pkg search for Crowdsec and also in the package
manager I can´t see an option to install it as a pkg.

SteveITS

@Dobby_ said in Crowdsec finally comming to pfSense:

do you know where to find "Crowdsec" for installing it on pfSense

It's a manual install and I want to say is therefore CE only? (not sure on that) A link was above:

@mmetc said in Crowdsec finally comming to pfSense:

The package can be installed by hand in the meanwhile

https://docs.crowdsec.net/docs/next/getting_started/install_crowdsec_pfsense

Dobby_

@SteveITS

Thank you I got installed now.

Antibiotic

Could some1 to explain, is it possible to read Windows PC log with Crowdsec installed on pfSense or need to install Crowdsec also for Windows PC?

provels

Is CrowdSec meant to replace pfB? Snort, Suricata? Augment them? Thanks.

Antibiotic

@provels You can read here:

"https://www.crowdsec.net/blog/suricata-vs-crowdsec"

I think Crowdsec blacklist working the same as pfBlockerNG, THE POINT of this, that pfBlockerNG limited to one hour update maximum , Crowdsec update more frequently I think!

provels

Looks like the pfSense install is not supported in FreeBSD 15 (24.03-RELEASE upgrade). Sad face.

mmetc

@provels this? https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3/freebsd-15-amd64.tar