IPS not showing alerts and Mass IPS DROP/Rule Enable? - Coming from PFSense

[romans6]

Kinda scratching my head at OPNSense's IPS. I am coming from 4+ years of PFSense. Thought the free ET rulesets from ProofPoint sounded great. Would love to use them.

Context -
Using PPPoE - Broadband
Using VLAN tagging to talk to the ONT on the side of my house
Tokens and OinkCodes are all working and valid
Enabled: Intrusion Detection
Enabled: IPS Mode
Enabled: Promiscuous Mode - Due to VLAN and IPS like helps says
Enabled: Syslog Alerts - So I can see if the rules work and tune if needed
Pattern Matcher: Hyperscan - Faster, but also tried Aho
Interfaces: WAN - For now

1. Not seeing anything under alerts. In PFSense I would see rules as they are hit.
2. Download tab - "Super Easy" to select and enable all and download.
3. Rules tab - Great I see all my rules and can choose to enable.

Q 1: Why Don't I see anything under alerts?
Q 2: Is there an easy way to set DROP to all on the download tab?
Q 3: Is there an easy way to set DROP to all on the rules tab? Not all in the view by clicking next to SID by 10 - 1000 but "ALL" as in all 49000+. This is where PFSense shines.
Q 4: Is there an easy way to "Enable" all in the rules tab akin to the DROP all question. By all I mean all 49000+. Again this is where PFSEnse shines.

[chemlud]

PPPoE - suricata - IPS might be the problem

https://forum.opnsense.org/index.php?topic=3630.0

?

[romans6]

That example talks about an old version. I am on v19. No chatter since Jan 2018. Wonder if they are still having problems.

I was using PPPoE with Surricata on PFSense just fine dunno why OPNSense doesn't like it.

Well back to PFSense until OPNSense fixes it. I really love the UI. Bummer I can't use it with PPPoE.

Still wondering about Bulk enable/block. Anyone have any insight on that?

[chemlud]

IMHO there is no suricata with IPS in pfsense. IDS is doing fine on both senses...

[hbc]

Q 2: Is there an easy way to set DROP to all on the download tab?

Just edit the ruleset on download tab and set policy to drop all alerts. Then all rules have drop action. Pretty easy.

[romans6]

IMHO there is no suricata with IPS in pfsense. IDS is doing fine on both senses...

@chemlud Let me know if you want to know how to actually enforce IPS on PFSense using VLAN/PPPoE until they get it working on OPNSense. Would love to help. Was hoping to switch over to OPNSense.

Screenshots Here:

[franco]

pfSense with Netmap has the same issue on PPPoE as far as I know. Your view of "it should be the same" is not rooted in a technical comparison of the settings deployed against Suricata and FreeBSD even though your expectation is the same. To me it even points to an issue with how "IPS" is being advertised in both products so that you think the one is what the other does but technically simply isn't.


Cheers,
Franco

[romans6]

OPNSense looks solid. Let me know if anything changes. Can't wait to use it with my setup.

[neoso]

My version of OPNSENSE is:

 OPNsense 19.1.10-amd64

WAN: PPPoE

Settings:
Enabble X
IPS Mode X
Promiscuous mode  X
Pattern matcher:  Hyperscan
Interfaces : WAN ( PPPoE)

The problem is in the alerts and logs is Empty.

The problem is the same in older versions of Suricata taht not inspection with Interface Wan is PPOE???

Any idea for solved this?


Thx