Packages wishlist?

rcfa · Jul 4, 2013, 8:03 PM

Since Snort is single-threaded, wouldn't it be nice to include a package for suricata (http://suricata-ids.org/) which supports mutli-threaded processing?

Ref: http://workshop.netfilter.org/2013/wiki/images/1/1f/Eric_Leblond_IDS-suricata.pdf

Looks like a great one. I also think the non-proprietary nature would make it a better fit, and with more and more GPU-power, CUDA support could make quite a difference in CPU load and allow for better utilization of existing hardware.
Also, Snort, over the past, seems to have been rather fickle, and quite the resource hog. Anything that's more efficient and less picky or easier to configure would be a good step forward.

xbipin · Jul 22, 2013, 5:58 AM

would love to have freeswitch

rcfa · Jul 22, 2013, 5:59 AM

@xbipin:

would love to have freeswitch

+1

rcfa · Jul 22, 2013, 6:07 AM

A STUN server package would also be VERY useful.

http://sourceforge.net/projects/stun/

Basically, as "low end" hardware gets more powerful, pfSense would be very useful to evolve into a "network border server" in addition to being a firewall router.

Tons of services that need to be available from the public net, and that one may not want to puncture the protective wall, could simply run on the firewall device: STUN, OwnCloud, FreeSwitch/Asterisk/PBSinAFlash, Suricata/Snort, privoxy/trackmenot/TOR, etc.

If we don't want a totally cluttered environment, at some point it may make sense to have "official" packages, which are fully integrated and tested to cover certain aspects of a network border server.

zenny · Jul 22, 2013, 6:15 AM

@rcfa:

A STUN server package would also be VERY useful.

http://sourceforge.net/projects/stun/

Basically, as "low end" hardware gets more powerful, pfSense would be very useful to evolve into a "network border server" in addition to being a firewall router.

Tons of services that need to be available from the public net, and that one may not want to puncture the protective wall, could simply run on the firewall device: STUN, OwnCloud, FreeSwitch/Asterisk/PBSinAFlash, Suricata/Snort, privoxy/trackmenot/TOR, etc.

If we don't want a totally cluttered environment, at some point it may make sense to have "official" packages, which are fully integrated and tested to cover certain aspects of a network border server.

To complement stun, STUN-over-TCP (http://sourceforge.net/projects/stunovertcp) would be a good combination with Vovida STUN (http://sourceforge.net/projects/stun/).

mystycs · Aug 28, 2013, 3:19 PM

ziproxy!

http://ziproxy.sourceforge.net/download.html

Derf · Sep 26, 2013, 9:08 AM

portspoof could be a nice addition

https://github.com/drk1wi/portspoof

Topper727 · Oct 6, 2013, 7:42 PM

I wish Snorby would be as a package. I have setup on another machine it is very handy. I don't want to have to run 2 machines to do this. I have enough CPU for both in firewall machine

lindsay · Dec 12, 2013, 5:23 PM

@rcfa:

@zenny:

Since Snort is single-threaded, wouldn't it be nice to include a package for suricata (http://suricata-ids.org/) which supports mutli-threaded processing?

Ref: http://workshop.netfilter.org/2013/wiki/images/1/1f/Eric_Leblond_IDS-suricata.pdf

Looks like a great one. I also think the non-proprietary nature would make it a better fit, and with more and more GPU-power, CUDA support could make quite a difference in CPU load and allow for better utilization of existing hardware.
Also, Snort, over the past, seems to have been rather fickle, and quite the resource hog. Anything that's more efficient and less picky or easier to configure would be a good step forward.

+1 from me

lindsay · Dec 12, 2013, 5:25 PM

@rcfa:

Actually a forum wishlist: make sub-sections for each package under the Packages section.
It's pretty hard to browse all relevant threads relevant to a particular package, it would be easier to have these threads grouped.
That would also make it easier for maintainers to have a quick look if there's activity, and for users to see if a package is alive.

1 from me too as i was ordering a adtrap wich do not work.
And to ship it back again is like ordering a new

marcelloc · Dec 13, 2013, 2:16 PM

this script may help you undestanding how to install it on freebsd.

Most of this are already done on snort package
https://github.com/shirkdog/snorby-bsd/blob/master/snorbyInstall.sh

Roman513 · Dec 19, 2013, 7:50 AM

strongSwan!

jimp · Dec 19, 2013, 4:41 PM

@Roman513:

strongSwan!

Keep an eye on 2.2 for that.

exograpix · Dec 23, 2013, 9:45 AM

Any antivirus solution for squid-dev or installation wayout.

Thanks

Trylen · Dec 30, 2013, 1:30 PM

A bandwidth monitor that allows you to keep track of Data Caps. Kind of like Traffic Accounting in IPCop.

twau · Jan 5, 2014, 3:39 PM

I would love a package that could remove spikes from RRD graphs. Cause sometimes when I reboot pfSense I get really high spikes on the graphs that is not normal, and it destroys the whole graph.

Some links about this matter:
https://github.com/mhagander/rrdclean
http://acktomic.com/2007/08/31/removing-spikes-from-rrd-databases/
http://www.serveradminblog.com/2010/11/remove-spikes-from-rrd-graphs-howto/

kilko · Jan 6, 2014, 6:33 PM

My Whishlist:

Simple "ifdown" package - reboot. (if not able to ping a given host, reboot pfsense)

..or can this be done with cron and a command directly on the box itself ?

GruensFroeschli · Jan 6, 2014, 8:19 PM

Why the hell would you want to reboot your pfSense???

kilko · Jan 7, 2014, 12:12 PM

@GruensFroeschli:

Why the hell would you want to reboot your pfSense???

Let my just state: that pfsense is unbeatable stable (for the price and functions available) and have been running for months and (would be years..) but my ISP is making "hiccups on the cable" which makes the traffic suddenly stop flowing.. Read more if you like here; http://forum.pfsense.org/index.php/topic,69879.msg381954.html#msg381954

I have 3 Reason:

1. When doing a controlled reboot all data /traffic etc is saved.
2. When my ISP is doing some upgrade/"fixing".. I sometimes reboot the cable modem.. and sometimes I have to reboot pfsense too, to get internet running again.
3. When I'm not home - and internet stoppes working, my system will try to get online again automatically. (and people don't have to start calling me ;-))

kilko · Jan 15, 2014, 7:21 PM

@kilko:

@GruensFroeschli:

Why the hell would you want to reboot your pfSense???

Let my just state: that pfsense is unbeatable stable (for the price and functions available) and have been running for months and (would be years..) but my ISP is making "hiccups on the cable" which makes the traffic suddenly stop flowing.. Read more if you like here; http://forum.pfsense.org/index.php/topic,69879.msg381954.html#msg381954

I have 3 Reason:

1. When doing a controlled reboot all data /traffic etc is saved.
2. When my ISP is doing some upgrade/"fixing".. I sometimes reboot the cable modem.. and sometimes I have to reboot pfsense too, to get internet running again.
3. When I'm not home - and internet stoppes working, my system will try to get online again automatically. (and people don't have to start calling me ;-))

If not a package, here is a howto: http://forum.pfsense.org/index.php/topic,71335.msg389446.html#msg389446