OPNsense Forum

Hi all,

We are very excited about this release. With the new Q-Feeds Connector, OPNsense is, as far as we know, the first firewall in the world where you can build firewall rules directly on MITRE ATT&CK mapping: block or allow traffic based on the tactics, techniques, software and groups behind an IP address.

The new version is available as a development package of the plugin (os-q-feeds-connector-devel). Before it goes to the production release, we would like as many people as possible to try it on real hardware with real traffic. If you use Q-Feeds today, or want to try it, your feedback is very welcome.

What is new

There is a new Security > Q-Feeds Connect > Firewall Aliases page. You create your own aliases and decide which IP addresses go into them, based on the full MITRE ATT&CK mapping: tactics, techniques, software and groups. Each of these has its own "include" and "exclude" selector, and every entry shows how many IP addresses it currently covers. Every alias you create appears as __qfeeds_<name> and can be used in firewall rules like the existing Q-Feeds aliases. For example, you can block every address linked to a specific threat group or malware family, or only log traffic tied to a certain technique.

The default aliases (such as __qfeeds_malware_ip) are still created, so existing rules keep working.

Please note: for now, the MITRE filters work for IP addresses only.

Coming next

In a future release we will also show the MITRE ATT&CK data on the Events tab, so you can see right away which tactics, techniques, software or groups a blocked connection is linked to. And we will also add this functionality to Unbound and DNScrypt-proxy.

How to get it

There is no need to switch your whole firewall to the development release. You only install the development version of the plugin, from the shell (SSH or console option 8):

• Take a configuration backup first (System > Configuration > Backups). Use a lab or non-critical firewall if you can.
• If you already have the Q-Feeds Connector installed, remove the current version first. Your settings and API key are kept:
  
  Code Select Expand
  pkg remove os-q-feeds-connector
• Install the development version (version 1.7.d at the time of writing):
  
  Code Select Expand
  pkg install os-q-feeds-connector-devel
• Check that your API key is filled in under Security > Q-Feeds Connect > Settings and press Apply. No paid subscription? Activate the promo license below first.
• Force a full update, so the MITRE data is loaded right away. Everyone needs to do this once, both new installs and upgrades:
  
  Code Select Expand
  /usr/local/opnsense/scripts/qfeeds/qfeedsctl.py fetch_index fetch db_update firewall_load unbound_load dnscryptproxy_loadThis can take a while. You should see lines like "downloaded ... entries", "database sync executed" and "load feed __qfeeds_...".

To go back to the regular version later, run:
pkg remove os-q-feeds-connector-devel
pkg install os-q-feeds-connector
No paid subscription? Test with 14 days of premium access

Testers who are not on a paid Q-Feeds subscription can use the promo code CALL-FOR-MITRE-TEST. It gives you 14 days of access to the premium feeds and the full MITRE mapping, so you can try the filters with the complete data set.

• Log in to the Q-Feeds Threat Intelligence Portal, or create a free account: https://tip.qfeeds.com
• Redeem the code at https://tip.qfeeds.com/views/activate_license.php
• Attach the test license to an API key. Without this step the license will not be active for the plugin.
• Enter that API key in Security > Q-Feeds Connect > Settings, press Apply and run the update command from step 5 above.

Useful commands

# show your licensed feeds and when the next update is due
configctl qfeeds info

# force a full update now: download, MITRE index, aliases and DNS blocklists
/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py fetch_index fetch db_update firewall_load unbound_load dnscryptproxy_load

# show the MITRE tactics, techniques, software and groups known to the local database
/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py get_ip_meta

# count the entries of an alias
pfctl -t __qfeeds_<name> -T show | wc -l

Reporting back

Please reply in this thread with:

• OPNsense version and plugin version (System > Firmware > Status)
• Hardware or VM specs
• What you tested, and what worked or did not work
• For problems: the output of the forced update command above, any errors from System > Log Files > Backend or General, and a screenshot where it helps

Reproducible bugs can also go straight to GitHub: https://github.com/opnsense/plugins/issues (please start the title with [os-q-feeds-connector-devel]).

A big thank you to Ad and the Deciso team for the work on this release, and thanks in advance to everyone who helps test it.

The Q-Feeds team