Taming the beasts… aka suricata blueprint

[abujammy]

jflsakfja thanks so much for all the time you've spent on getting this up and running.  I read through the ridiculously long thread on getting the half dozen sentences you wanted in order to begin working on the guide.  Now that that's done, what's the timeframe looking like on that and what kind of help do you need to get started?

[Mr. Jingles]

@abujammy:

on getting the half dozen sentences you wanted in order to begin working on the guide.

and what kind of help do you need to get started?

I've read this more than once, but I think I'm not quite sure what the question is. Now I'm not JFL, so your question isn't directed at me, but I'm still being curious as to what the question is ( ;D ).

[abujammy]

hahahaha well I thought it was pretty clear. ;)

Let me try to be more clear.  Do you need:

• Someone to help edit for English grammar?
• Someone to convert some of the forum topics over to github so that you can edit from there?
• Someone to grab pfSense screenshots, crop them and put them in a repo somewhere?
• Someone to write a section from scratch?
• etc
• etc
• etc

[A Former User]

Still recovering and becoming a regular at the doctors'. Went through everything so far, x-rays, CTs, EMGs, MRIs…(notice the "s" at the end of each one). Still have 2 MRIs to go through, but that's going to take a while, not scheduled for another 4 months or so. Not saying that the guide is going to be delayed until then, but for now, I'm more focused on easing back to my regular life and workflow.

I only ask for your patience for now  :). Bone marrow and nerves are slow in recovery...

The upside is that my head is still attached to my neck, that's good!

[TDJ211]

@jim82:

@jflsakfja:

Can I see a screenshot of the floating rule in question?

If you are talking about the "block all" floating rule, it should only apply to traffic destined for pfsense's ports (that's why there is a giant red warning under it).

Thanks for your reply. I guess the post above concerns the same confusion. Don't get me wrong, but you write the following:

Next up Floating tab:
Set up a rule but make these changes:
Action  Block
Quick  TICKED!!!
Interface  Hold CTRL and click on all interfaces EXCEPT LAN(admin) and SYNC
Direction  any
Source  any
Destination  any

If you read this directly(as I did, since I'm absolute beginner), your rule will block everything in/out on all interfaces, except "LAN".

I did this, and got confused. I could not wrap my head around, how on earth a Floating block ANY ANY ANY to all interfaces would possibly allow any traffic to pass through.

My suggestion is to clarify(maybe more red big letters) that this floating block rule is ONLY for the ports you specify as being web interface and SSH(which makes good sense).

Thanks for your guide, I'm looking forward to following the next steps.

BR Jim

Ahhhhh….thanks for the clarification! I read it that way too.

[dmitri_oga]

@jflsakfja:

Next up Floating tab:
Set up a rule but make these changes:

| Action | Block |
| Quick | TICKED!!! |
| Interface | Hold CTRL and click on all interfaces EXCEPT LAN(admin) and SYNC |
| Direction | any |
| Source | any |
| Destination | any |

DON'T CHANGE DESTINATION PORT RANGE!!! Had to add this since I confused a few people already :p

Those are pretty much the only changes you need to make. Save and apply the rule. When adding other floating rules, make sure this rule stays at the absolute top of the list.

I am either missing something or this is truly going over my head and I apologize for resurrecting an old(er) thread.

When I add the Floating rule, all traffic on my network grinds to a halt.
Can someone explain to me how to set it up correctly? I apologize for this, I've looked over the thread several times and can't come to an answer. I tried varying setups and, still, nothing.

Here's a link to my current rules:
Floating: http://i.imgur.com/oqVGRyD.png
WAN: http://i.imgur.com/kezi74q.png
LAN: http://i.imgur.com/n7g15kf.png

Thanks.

P.S., hope you're alright, jflsakfja. :D

[n3by]

you missed the destination admin ports for your pfsense box.

[dmitri_oga]

@n3by:

you missed the destination admin ports for your pfsense box.

So, they need to be in the LAN and Floating section? Also, I noticed I might've mislabeled the LAN and WAN Imgur links. Sorry.

[n3by]

Be careful with chosen ports, not to be used by normal applications because you will cut access to this ports.

You will put restriction rule from LAN only if you want to have specifics designated computers that can access the admin ports.

Attached floating rule for WAN and rule for LAN.

p.s.
you can use as destination: "This firewall (self)" instead of any


[dmitri_oga]

@n3by:

Be careful with chosen ports, not to be used by normal applications because you will cut access to this ports.

You will put restriction rule from LAN only if you want to have specifics designated computers that can access the admin ports.

Attached floating rule for WAN and rule for LAN.

p.s.
you can use as destination: "This firewall (self)" instead of any

Appreciate it! Thanks a lot. Kudos.

[A Former User]

So long and thanks for all the fish.

[pfcode]

@jflsakfja:

So long and thanks for all the fish.

Oh, NO.  r you leaving us? whats happening?

[G.D. Wusser Esq.]

@jflsakfja:

So long and thanks for all the fish.

Farewell. Thank you for everything.
Hoping you will return.

[pfsenseboonie]

Hi I am trying to create the golden custom rules and need help…

alert tcp $EXTERNAL_NET any -> $HOME_NET ![ports,open,on:firewall] (msg:"Blocked close TCP"; classtype:attempted-recon; sid:9900000; rev:1;)
alert udp $EXTERNAL_NET any -> $HOME_NET ![ports,open,on:firewall] (msg:"Blocked close UDP"; classtype:attempted-recon; sid:9900000; rev:1;)
alert tcp $EXTERNAL_NET [0:1023] -> any [0:1023](msg:"Blocked close TCP"; classtype:attempted-recon; sid:9900000; rev:1;)
alert udp $EXTERNAL_NET [0:1023] -> any [0:1023] (msg:"Blocked close UDP"; classtype:attempted-recon; sid:9900000; rev:1;)

the first two are to block incoming to closed ports.
the last two to block incoming from low ports to low ports.

How should i adjust them in the msg bit or any other comments on them.

Thanks.

[lobotiger]

Hi everyone. I'm thinking of following the guide here but jumping to the last page I noticed that jflsakfja indicated that he will no longer be on this forum.  Is it worth reading 30 pages to get this setup?  Is the snort page any better?

LoboTiger

[n3by]

My advice is to install Suricata if possible.
Yesterday I just had to uninstall Snort and installed Suricata from one remote site after I seen high CPU load and high CPU temp without traffic. Reason Snort >10-15% CPU - in the same conditions, now it is ok Suricata 1-2% CPU.
The other site had Suricata installed and no problems; both sites are running pfSense 2.2.5 & vpn site to site.

[Downloadski]

@lobotiger:

Hi everyone. I'm thinking of following the guide here but jumping to the last page I noticed that jflsakfja indicated that he will no longer be on this forum.  Is it worth reading 30 pages to get this setup?  Is the snort page any better?

LoboTiger

I am a absolute beginner and i found this thread very interesting to get some understanding of the principles of good security.
So i wil re-read it and start to implement it.

[TDJ211]

@lobotiger:

Hi everyone. I'm thinking of following the guide here but jumping to the last page I noticed that jflsakfja indicated that he will no longer be on this forum.  Is it worth reading 30 pages to get this setup?  Is the snort page any better?

LoboTiger

It's probably the best read you'll find on the net about IDS/IPS security. Most of what you need to know is in the first few pages anyway….

[glint.bladesong]

SO… all quiet on the western front?

Did I miss a memo somewhere about what happened to this project, or the guide v2?

[2chemlud]

Not an expert, but I guess… yes

https://forum.pfsense.org/index.php?topic=88244.0