Suricata on Pfsense

bmeeks

@bmeeks thanks for the update. Now I understand.

And although the GUI package version in 25.03 BETA still says 7.0.8, the underlying binary is the new 7.0.10 version of Suricata from upstream. There are no differences in the PHP code, so the GUI package is unchanged.

sstatjm

oh ok. Thanks again

sstatjm

So since there is no version 25.03. There is an official 25.07 now but only get a 7.08.2 what happen to the rest up to Suricata 7.0.10 or 7.0.12?

NRgia

@bmeeks Hello Bill, as others have stated, the code did not reach the final version of pfSense 25.07. Can you check with the developers? Thank you

bmeeks

@NRgia said in Suricata on Pfsense:

@bmeeks Hello Bill, as others have stated, the code did not reach the final version of pfSense 25.07. Can you check with the developers? Thank you

Sorry, but I am no longer able to actively maintain the IDS/IPS packages. You will need to directly address this with the Netgate team through the pfSense Redmine bug/feature reporting system here: https://redmine.pfsense.org/projects/pfsense.

SteveITS

@bmeeks :( well thank you for your time, sir. 🫡

NRgia

@bmeeks Thank you for what you did for Snort or Suricata. I'm not sure what you want me to do on Redmine, due to is a bug tracker.

My question is for Product Management, which I will ask it here to be public: What is the plan for these 2 packages, Suricata and Snort?

Thank you

bmeeks

@NRgia said in Suricata on Pfsense:

@bmeeks Thank you for what you did for Snort or Suricata. I'm not sure what you want me to do on Redmine, due to is a bug tracker.

My question is for Product Management, which I will ask it here to be public: What is the plan for these 2 packages, Suricata and Snort?

Thank you

Yes, Redmine is for both bug reports and feature requests. Asking for the Suricata binary to be updated to the latest 7.0.11 version from upstream is a legitimate Redmine request. I would suggest simply asking for the binary version update instead of asking about future Netgate strategy (such as the support plans for the packages). Strategy discussions typically don't get very far because they deal with proprietary information or plans that a company may not want to publicly discuss.

Redmine is where the Netgate developer team tracks all the code changes they make for pfSense. They will see Redmine reports much quicker than a forum post.

btspce

@NRgia I have created an redmine request now as the binary was not updated in the recent update and there was no answer from netgate here in all this time.

NRgia

@btspce Thank you. Do you know if this will be the process to follow moving forward? Normal users are required to open tickets in order to get updates? Or is there a point of contact that we can nudge for this cases.

SteveITS

@NRgia

Redmine is where the Netgate developer team tracks all the code changes they make for pfSense

Redmine is a bug/feature tracker.

Generally newer versions of pfSense have newer versions of various software (FreeBSD packages) that are included in the base install.

pfSense packages like Snort/Suricata or other "not included by default" software are maintained separately and may or may not get updated when pfSense is updated, and sometimes are updated in between.

If you have a redmine.pfsense.org account there is a Watch link at the top right of each request/issue, next to Edit.

It's unclear from above who is maintaining the Suricata package now.

bmeeks

@SteveITS said in Suricata on Pfsense:

It's unclear from above who is maintaining the Suricata package now.

The package no longer has any active maintainer. The Netgate team did decide to address a couple of recent PHP GUI package CVEs themselves (that's the recent update to 7.0.8_3, I believe). I would not expect Netgate to takeover continuous maintenance of the package as it is not a core package of pfSense.

Best case is for another community member to step up and take over package maintenance.

P.S. -- I did send a detailed email a couple of weeks ago to the pfSense developer team letting them know of my retirement from package maintainer duties. They acknowledged receipt of the notice, so they are aware of the current package status (ditto for the Snort package, too).

NRgia

@SteveITS I understand, but let's speak from the user/client point of view. Why a client must raise tickets in a bugtracker like Redmine or Jira or whatever? A client expectation is that, if a package is available, to be updated or maintained.

If the package is not maintained it will become a security and performance issue with time.

I mean I understand, maybe, Netgate doesn't have resources, but then, they can remove it, instead of waiting for something to happen...

Just my 2 cents.

@bmeeks Your suggestion is preferred, but from I understood from you, nobody is interested or have the knowledge.
Again thank you, for updating this package over the years.

bmeeks

@NRgia said in Suricata on Pfsense:

Your suggestion is preferred, but from I understood from you, nobody is interested or have the knowledge.
Again thank you, for updating this package over the years.

I'm sure there is someone here on the forum using the package that has the knowledge to maintain it.

Another option if IDS/IPS is critical is to use the Linux package on a separate virtual machine or hardware appliance. Inline IPS performance would actually be very good using a Linux box (or even a FreeBSD box) with two separate NICs and configure true netmap hardware-to-hardware mode. That is many times more performant than the hardware-to-host mode that is required when using netmap within pfSense.

Of course using a separate box would mean no GUI, but that's how the vast majority of the world uses Suricata already (without a GUI).