Python and pfSense

[John Willard]

Hi there - I understand most of the fundamentals of Python (will learn the rest as needed at this point) and I want to get into automating the task of pulling source IPs and destination ports to record port scans and report them to AbuseIPDB. Starting from knowing most of the fundamentals of Python - what else should I read up on to help me achieve this task? I.e. Does pfSense have an API I haven't been able to find, do I need to use an IDS like Snort, etc.?

[Gertjan]

@John-Willard

pfSense has python.
Open up a command line : console, or SSH into pfSEnse, and fire it up :

[23.09.1-RELEASE][root@pfSense.bhf/tld]/root: python3.11 -h
usage: python3.11 [option] ... [-c cmd | -m mod | file | -] [arg] ...
Options (and corresponding environment variables):
-b     : issue warnings about str(bytes_instance), str(bytearray_instance)
         and comparing bytes/bytearray with str. (-bb: issue errors)
-B     : don't write .pyc files on import; also PYTHONDONTWRITEBYTECODE=x
-c cmd : program passed in as string (terminates option list)
-d     : turn on parser debugging output (for experts only, only works on
         debug builds); also PYTHONDEBUG=x
........

Be aware : pfSense is a firewall, not a dev system.
You'll have a hard time pulling in more packages and other tools that maybe not present in the base system.

@John-Willard said in Python and pfSense:

Does pfSense have an API

pfSense is build upon the FreeBSD kernel, and that one is 100 % open source.
But again : it's probably not on pfSense that you develop anything, it's not the correct environment.

Btw : Snort, Surriata, Wireshark etc are all binaries, certainly not "interpreted scripts" ;)