Snort 2.9.7.5

bmeeks

thanks,…

can you add a counter for all enabled rules in Snort om first page? :)

Do you mean on the package home page (the one showing the list of configured Snort interfaces), or are you talking about somewhere on one of the interface-specific tabs?

Bill

simby

LAN interface 34769 rules enabled
WAN interface 41651 rules enabled

On first Snort interface status :-)

bmeeks

@simby:

LAN interface 34769 rules enabled
WAN interface 41651 rules enabled

On first Snort interface status :-)

OK. Will see what I can do. Space is a bit limited on that screen unless you are using the new full screen theme.

Bill

pfcode

@bmeeks:

@simby:

LAN interface 34769 rules enabled
WAN interface 41651 rules enabled

On first Snort interface status :-)

OK. Will see what I can do. Space is a bit limited on that screen unless you are using the new full screen theme.

Bill

What/Where is the new full screen theme?

simby

@bmeeks:

@simby:

LAN interface 34769 rules enabled
WAN interface 41651 rules enabled

On first Snort interface status :-)

OK. Will see what I can do. Space is a bit limited on that screen unless you are using the new full screen theme.

Bill

Under interface , maybe: LAN 37125 rules enabled of all 43777

bmeeks

@pfcode:

What/Where is the new full screen theme?

It's under System > General Setup. Select the pfsense_ng_fs theme.

Bill

simby

@bmeeks:

Working on it now. Should be posting a Pull Request to pfsense-tools in a few days. I'm experimenting with adding a long-requested feature to the blocking plugin… ;)

Bill

Any news? :-)

bmeeks

@simby:

Any news? :-)

Still working. A family illness issue has delayed my progress for a bit. The changes in 2.9.7.5 from upstream are pretty minor, so I don't think there is a huge impact in delaying introducing them in the pfSense port. The new feature I'm adding will be a big help, though, so I think it's worth holding up the 2.9.7.5 update while I finish integrating the new feature. The new feature uses multithreading to continuously watch the firewall interfaces for IP address changes and then immediately updates an internal PASS LIST to prevent errant blocking of say the WAN IP for folks with dynamic WAN IP addresses. I have a proof-of-concept working for this feature and just need to finish up the production code.

The next logical step, assuming the new feature works as intended in widespread production, is to expand the multithreading idea and support FQDN aliases in the PASS LIST. That is my goal, but that part is not started yet.

Bill

simby

@bmeeks:

@simby:

LAN interface 34769 rules enabled
WAN interface 41651 rules enabled

On first Snort interface status :-)

OK. Will see what I can do. Space is a bit limited on that screen unless you are using the new full screen theme.

Bill

Bmeeks, will be this in this release?

bmeeks

@simby:

Bmeeks, will be this in this release?

It's not in the currently open Pull Request.

Bill