Snort 3 on Nexus Breaks Routing

brezlord

Hi all,

When I remove Snort 2 and and install Snort 3 using the new Nexus controller and setup Snort on the pre-compiled Balanced rule set applied to the WAN - the Netgate 4200 stops routing and I lose access to the device. I can not even ping it when directly connecting to the device via ethernet.

The only way to get access again is by serial console and running pfctl -d and disabling the firewall - with the WAN physically disconnected of course.

I can't find any info on the Netgate docs site with regards to Snort 3 in Nexus.

Does anyone have any idea what might be happening and is there any documentation on Snort 3 you can point me to.

Thanks.

stevo11811

Hello, I ran into a similar issue, I narrowed mine down to rules being enabled unintentionally.

The software seems to enable every single rule downloaded from Snort's package regardless of the ruleset applied (Balanced, max-security, etc etc), this causes it to block everything,

Between that and the lack of documentation it's been very hard to troubleshoot.

brezlord

Below is the response that I got from TAC:

*I'm sorry but our support for Snort is limited: https://www.netgate.com/supported-pfsense-plus-packages

and we don't have any official guide for it.*

This is laughable considering that you have to have pfSense + to have Nexus and that Sort 3 is only available with Nexus.

marcosm

Docs for Snort 3 in Nexus are being worked on. Indeed the issue is likely with the rules being enabled unintentionally. Feel free to report the issue at https://redmine.pfsense.org/projects/pfsense-plus under the Nexus category.

jimp

If you had to disable pf, odds are it was set to block and something necessary for routing ended up blocked due to a false positive alert.

Docs for Snort 3 are up now:

https://docs.netgate.com/pfsense/en/latest/nexus/snort/index.html

Including a basic setup recipe with some important information about what to do/not to do when first setting it up:

https://docs.netgate.com/pfsense/en/latest/recipes/snort3.html

Be sure to check for an update Nexus from the package manager if you haven't already, the updated Nexus builds fix some issues in the Snort 3 package.

brezlord

Thanks for the information. I think my error was enabling "Inline IPS". Everything else was setup as per the recipe.

I have a Netgate 4200 so unsure if Inline IPS is sported.

I have updated to the latest build of Nexus 26.07_2

I just need to work out why IDS logging will not enable. You can toggle the switch but it will not stay on and I can see the alerts in the logs.

brezlord

I have been trying to get Snort 3 configured and back to a working state similar to what I had in the old Snort 2.

If I enable Snort 3 on the WAN interface with no rules enabled I still get my WAN and WireGuard IP blocked with in seconds.

Snorts internal scanner seems to be the the cause.

port_scan = default_med_port_scan

GID 122 alerts are coming from the Snort 3 Port Scan inspector, rather than Snort subscriber rules.

ICMP filtered sweep
UDP filtered portscan
UDP filtered portsweep
IP filtered protocol sweep
TCP portsweep

I have no idea where to go now. Even putting the below in the Custom Lua confi tail does not fully solve the problem.

port_scan.ignore_scanners = '<WAN IP>,<WG IP>'

I do have public facing Open VPN and ports 80, 443.