suricata rules

jc1976

Hey Folks, i'm hoping a pro can help me here.

The other day i subscribed to an IPTV (realmIPTV) and suricata is blocking the hell out of it and causing a ton of problems. I can start a show, it'll go for a little bit, and just when i think i've killed/suppressed the correct rule, bam! it all stops. the only way i can watch tv without problems is if i disable suricata, which really sucks!

google ai helped me craft a rule but it doesn't do anything.

pass http $HOME_NET any -> $EXTERNAL_NET any (msg:"Whitelist IPTV Provider"; content:"line.realmtv.cc"; http_header; sid:999999; rev:1;)

pass ip any any <> 127.0.0.1 any (msg:"Pass Threadfin Localhost Traffic"; sid:1000001; rev:1;)

any advice??

SteveITS

@jc1976 I wasn’t aware it had allow capability…??

There is a pass list if you know the remote IP(s).

But what rules are triggering?

Bit surprising they don’t have an encrypted connection.

jc1976

I couldn't tell you which rules.. i see a bunch that are pointed at the ip address of my plex server but even after disabling the rules that are causing problems, it still keeps getting hung-up. and suricata is soooo slow to post the alerts.. it's not like an alert gets triggered and "BAM!" thats it.. the data stream would hang up and i wouldn't see the alerts come thru for a while, and i never altered the refresh, so.. it makes it annoyingly difficult to diagnose. PLUS, i don't wanna keep disabling these rules because who knows how many bugs or problems those rules have prevented from getting inside my network.

yeah, i'm thinking it's a crappy iptv service. i read that if you have an issue, they get back to you within minutes... i reached out to them hours ago and i haven't heard back. so probably gonna drop them, but that's besides the point..

Gertjan

@SteveITS said in suricata rules:

Bit surprising they don’t have an encrypted connection.

Non-TLS traffic permits Suricate to see the actual payload : the data part in the packet.
Imho, very rare situation.
Normal that Suricate goes in overdrive on this traffic, as 'visible', none encrypted doesn’t (shouldn't ?) exist anymore these days.
That said : on video traffic it can only generate false positives.

@jc1976 said in suricata rules:

if i disable suricata, which really sucks!

Is your network that special that you need Suricata ?
You are aware that nearly all Ethernet traffic (like 99,9 %) is TLS encryped these days so Suricata sees .... nothing (random data = nothing) ?
The good old MITM days are really over.

bmeeks

Ditch Suricata and enjoy your streaming experience. As others have stated, 99% or more of the traffic on the Internet today is encrypted. Suricata cannot see anything related to packet payloads when the connection is encrypted. That means Suricata's rules are doing nothing for security. But they can and will most definitely generate false positives that kill your network for no good reason -- which you are experiencing according to your post.

I give you this advice as the former creator/maintainer of the Suricata package on pfSense. If you have configured the default DENY ALL rule on your WAN interface, you are pretty well protected from any unsolicited incoming traffic. And if you exercise a bit of common sense about what you click on in emails and what websites you visit in a browser- and have a decent anti-virus product on each internal host- then you are fine security-wise.