Suricata true inline IPS mode coming with pfSense 2.3 – here is a preview
-
Paraphrasing, you wrote:
You must use IP REPUTATION at the moment to implement a pass list (whitelisting) feature with inline mode.
Suricata does have an IP Reputation module, and that feature is exposed in the GUI package for pfSense. You will need to manually create a "whitelist" of IP addresses you want to never block and add that list to the IP REP tab. There are options on that tab for how to treat the list you create (whitelist or blacklist).You can also create custom PASS rules and use those if you are fluent in writing Suricata rules. That's the best I can offer at the moment.I will look into how easy it might be to automate that process and somewhat integrate it into the existing Pass List code used in Legacy Mode.
EDIT: scratch part of what I said about using IP REPUTATION. That will only work on Snort. Sorry I confused the two in my head when posting originally. The only solution I can see to implement a Pass List with Suricata using inline IPS mode is to implement PASS rules. I believe I can make that automatically happen within the GUI code. I'm working on a solution to include in an upcoming package update. -Bill
I would like to point out the following.
1) I can find no detailed explanation in the documentation on either the pfSense or the Suricata websites as to how to use the IP Reputation list feature. The syntax is outlined, but not how to use IP Reputation in a rule to achieve any purpose. In any event, although repeatedly told this is required to "whitelist" addresses that would otherwise be dropped by a rule, we are now told this won't work at all.
2) My understanding from my reading of what there is to learn about IP Reputation (or is it Pass lists?) lists, any Aliases used can't include FQDN. This is a very serious limitation.
3) It is unclear whether the use of Suppress lists will "whilelist" an address that is dropped by a rule. My testing would seem to indicate that Suppress simply prevents the Alert logging while the address is still blocked due to the rule.
4) It is unclear whether Suricata in IPS mode blocks addresses for a period of time as specified in Services -> Suricata -> Global Settings -> General Settings –>Remove Blocked Hosts Interval or if the block is only for the specific (instantaneous) traffic only. At issue is that, without the Block list page, and with the Alert page continuing to fill, it is no easy feat to find what traffic has been blocked-- let alone take any action to prevent it in the future.
5) We are told using Pass lists won't work either.
6) In an explanation of the Enable/Disable vs Disable/Enable toggle with SID Management, you wrote, "The logic excludes based on the largest net. So if you disable a category by putting it in the disablesid.conf file, then none of that category's rules can be used. Enabling individual SIDs from an excluded category in the enablesid.conf file is not possible (because the whole category has been excluded). It would be better to use SID ranges from the category in the two files and work out a solution that way. The biggest "excluding" statement wins between the two files (enablesid and disablesid)." Is this explanation right? I'm sorry, but the list of rules is chosen based on a vote of who gets the most votes? (Do the Russians get to "vote" as well?) Surely, if the order is Disable/Enable, and you disable a category then enable a particular rule in the category, that rule is enabled, no?!
You conclude (after correcting the longstanding misinformation that IP Reputation lists, which are undocumented anyway, are the only supported/possible way to not drop traffic otherwise dropped by a rule) only "those ... fluent in writing Suricata rules" will have any means to solve the issue ("That's the best I can offer at the moment"). You go on to write, "The only solution I can see to implement a Pass List with Suricata using inline IPS mode is to implement PASS rules. I believe I can make that automatically happen within the GUI code. I'm working on a solution to include in an upcoming package update."
That was January 13, 2017, 08:18:29 am.
Do we have a solution for those of us who are not "fluent in writing Suricata rules"? Could you clarify the current state of affairs with respect to Suppress lists, Pass Lists, SID Management Enable/Disable ordering, IP Reputation lists and any GUI implementation of "Pass List" functionality.
Thank you.
EDIT: I must assume I am now "fluent in writing Suricata rules", as I have solved the issue (in a simple case). Using SID Management with Modify rules, I was able to modify a rule's Destination to exclude a sequence of IP addresses. I was temporarily setback by the examples in the Suricata documentation which included spaces between the addresses (when creating Aliases), but, at least with rules, there can be no spaces. ESET Cyber Security Pro can now send "Outgoing Basic Auth Base64 HTTP Password detected unencrypted" to its update servers unhindered.
-
If I may request (some) feature(s):
– on the Suricata -> Interfaces -> select to edit (e.g., WAN) -> WAN Rules page, the footer "Category Rules Summary" would be nice to (also) have available to view at the top of the page
-- that the "Rules View Filter" section always be open (or that the option to always be open can be configured)
-- that selection boxes be available for all the various SID Management categories (i.e., Default Enabled, Enabled by user, Auto-enabled by SID Mgmt, Rule action is alert. Action and/or content modified by SID Mgmt, Default Disabled, Disabled by user, Auto-disabled by SID Mgmt, and Rule action is drop).
-- that the columns on the page be sortable by clicking on the header.
-- that a Category "ALL" be available to see ALL rules and their actions.
-- that Source and Destination be Editable fields to solve the previously mentioned issue with "whitelisting". If implemented, thorough documentation/help/how to information be available right there for those of us who are not Suricata rule experts but need rules to work nonetheless. Clearly, the original rule needs to be maintained, with custom edits that can be saved and reused, including aliases and their logic (i.e., NOT/AND/OR).
-- that clicking on a SID to view rule show both the original and active rule (and not as a javascript pop-up).
Easier navigation in the Suricata menus would be appreciated: the requirement to choose Edit on the Interface, so that all pages within can be viewed up front needs to be eliminated and all pages flattened so they can be viewed initially.
In the Suricata menus (and in pfSense itself) it would be helpful to have an easy way to move between frequently accessed pages. For example, a Start Page with Icons to open frequently used pages either below the Icons in a frame (keeping the Icons available) or in a separate tab (such that if re-clicking on the Start Page icon will re-open the existing tabbed page). Even just having Icons on every page with links to open (in an existing tab if possible) frequently accessed pages (e.g., Dashboard, the various pages of Logs, Interface pages, Rules pages, etc., etc.
-
Last question, it appears that Snort is still not capable of inline mode (with pfSense), true?
-
Good day.
PFsenes 2.3.4-RELEASE-p1 (amd64) FreeBSD 10.3-RELEASE-p19
I have a I350-T4 network card installed.
As I understand the drivers for this network card do not support a Netmap (At least in the current release PFsense), because when switch to the inline mode, I stop showing alerts?!
Sorry for my bad english. -
Last question, it appears that Snort is still not capable of inline mode (with pfSense), true?
Correct, Snort cannot do inline IPS mode on pfSense. Snort implements Netmap, but only through its DAQ module. And the way DAQ implements it is quite different from the way Suricata does. Snort's DAQ requires you to actually dedicate two real network interfaces to the Netmap tunnel. One is "IN" and the other is "OUT". The DAQ takes incoming traffic on the IN and sends it to Snort. Snort either drops it if bad, or sends it back to DAQ if OK. DAQ then sends what it gets from Snort out the OUT interface. It is meant to really run as a completely separate appliance sitting in series with the protected networks. You can't route any traffic between the interfaces either. They are just two ends of the same pipe in a manner of speaking.
Suricata implements Netmap natively (without needing DAQ), and does so in a manner more conducive to IPS mode operation within a firewall. You don't have to use two real interfaces. You specify the real interface where you want Netmap to operate, and then to connect to the OS kernel stack you specify the same interface name but with a plus ("+") at the end. Suricata's Netmap can insert itself between the kernel stack and the NIC driver. Snort's DAQ can't do this.
Bill
-
Good day.
PFsenes 2.3.4-RELEASE-p1 (amd64) FreeBSD 10.3-RELEASE-p19
I have a I350-T4 network card installed.
As I understand the drivers for this network card do not support a Netmap (At least in the current release PFsense), because when switch to the inline mode, I stop showing alerts?!
Sorry for my bad english.Probably true. I don't have a list of exactly which drivers fully support Netmap. I know there are several out there that work great, and some that work in a buggy fashion, and then some that don't work at all. If you have trouble with Inline IPS mode in Suricata with your NIC hardware, you either have to change the NIC to one that is supported or switch to Legacy Mode blocking and abandon Inline IPS.
You could try posting an open question to Suricata users here on the forum to see who is successfully using Inline IPS mode and with which type of network card.
Bill
-
Well, thanks for the answer!
I would like to know whether the latest drivers for my network card are in PFSense, maybe they can be updated or can be upgraded in version 2.4 with another core of the FreeBSD?! -
Well, thanks for the answer!
I would like to know whether the latest drivers for my network card are in PFSense, maybe they can be updated or can be upgraded in version 2.4 with another core of the FreeBSD?!pfSense uses whatever is in FreeBSD upstream. They do not create their own network drivers. pfSense 2.3.4 is based on FreeBSD 10.3-RELEASE. The pfSense 2.4-DEV tree is based on FreeBSD 11, so it is likely to contain more up-to-date network drivers. Which pfSense version are you running? You could give 2.4-DEV a try if you want to. Perhaps it has drivers for your hardware that support Netmap.
Bill
-
Good day.
Maybe you guys can help or give some advises.
Have NetXtreme BCM5720 Gigabit Ethernet PCIe, and inline mode works. But from time-to-time it starts to drop traffic on either internal or external interface.
In logs i see a lot of messages like this:
728.051395 [2860] netmap_transmit full hwcur 793 hwtail 680 qlen 112 len 74 m 0xfffff8000d78e000
Rebooting machine or bringing interface down then up usually helps. Today first time it came up on itself, after dropping traffic for about an hour or so.
Can it mean NIC not fully support netmap? Or is it just some miss-configuration from my side? Would be glad for any help.
-
Don't use inline mode.
-
Good day.
Maybe you guys can help or give some advises.
Have NetXtreme BCM5720 Gigabit Ethernet PCIe, and inline mode works. But from time-to-time it starts to drop traffic on either internal or external interface.
In logs i see a lot of messages like this:
728.051395 [2860] netmap_transmit full hwcur 793 hwtail 680 qlen 112 len 74 m 0xfffff8000d78e000
Rebooting machine or bringing interface down then up usually helps. Today first time it came up on itself, after dropping traffic for about an hour or so.
Can it mean NIC not fully support netmap? Or is it just some miss-configuration from my side? Would be glad for any help.
Could be a buggy Netmap implementation by the driver, but you might try fiddling around with buffers. I'm no expert, but others have posted here about various mbuf settings that can be adjusted for certain NICs. These have helped with some Netmap and other NIC driver problems.
Bill
-
Well, replacing NICs on the server to ones, that officially support Netmap and configuring them according to recommendations in https://doc.pfsense.org/index.php/Tuning_and_Troubleshooting_Network_Cards seems to fix the issue. Have not observer such problem in last 30 days.
Thank you for the help bmeeks.
-
I have followed all the recommendations in the tuning guide and I still get a ton of bad pkt errors. Using an intel i350. Also tried Intel i219.
Is anyone else using the i350 successfully?
