No Alerts using Suricata inline mode.
-
Hi Bill, I saw there was a new Suricata package, updated, enabled Inline mode, and am seeing alerts/blocks! Hooray!
Semi-related to this thread, since we were talking about pass lists, I noticed the Pass List setting was removed for Inline mode. We had a few external things in there like our anti-spam service and our web server cluster, that we didn't want to block. Is there still a way to accomplish that? Or just add to the suppress list as alerts happen?
Thanks,
Steve -
Never mind, I found the release notes at https://forum.pfsense.org/index.php?topic=145489.0 and even better https://forum.pfsense.org/index.php?topic=145257.msg790339 that discuss pass lists.
-
@teamits:
Never mind, I found the release notes at https://forum.pfsense.org/index.php?topic=145489.0 and even better https://forum.pfsense.org/index.php?topic=145257.msg790339 that discuss pass lists.
You can use custom PASS rules to create a pass list, but just be careful as I warned in the posts you linked. It is probably better to watch and either disable the bothersome rules, or use suppress lists and either of the "filter by IP" options that are available when you click the plus sign (+) beside the IP address columns on the ALERTS tab. Doing it that way allows a rule-by-rule tuning and even limiting that to certain hosts (IP addresses). Using a pass list is more like using a large hammer when what you really need is a jeweler's screwdriver. With a PASS rule that filters only on an address, you are potentially exposing the whitelisted host to a lot of malicious stuff.
Bill
