Topics

Good morning, after fully configuring my network, following the advice on the forum and reading tutorials, etc... I have started to configure a protection in upper layers, unfortunately my hardware is not enough to support Zenarmor, I have installed and configured Suricata and it has been a disaster. Possibly due to some configuration that I am not doing well. I have chosen to enable it in the internal networks according to the general recommendation.
I have several questions:
1. My network is configured with several bridges to extend the vlans between several cards. Example: vlan1_salon (igc0)->bridge0->vlan1_rooms(igc1). In the system tuneables configuration, filtering is disabled on the interfaces and enabled on the bridge.
All hardware acceleration features are disabled and promiscuous mode is enabled.
In the IDS/IPS interface configuration do I have to select the bridge interface alone?
2. In the $HOME variable I have deleted the predefined networks and set all my subnets/vlans to CIDR. Do I have to define all of them including those not selected in "Interfaces"?
3. Regarding the rules. I have installed the plug-ins for ET Telemetry and Snort, but they are a huge amount for my experience. I have uninstalled both plug-ins to start with the basics, but I cannot delete the rules that had already been downloaded. I understand that enabling the open rules for ET, abuse.ch and the built-in application detection rules is enough for basic and initial protection?
Thank's in advance.

Hello everyone,
I have tried to extend the vlans of my network to other ports over a bridge and I have not been able to get it to work properly. In some cases the devices on the vlans communicate with each other but in others they do not.
I have read old posts from two years ago in which this type of configuration is discouraged, and they talk about a limitation in the FreeBSD architecture.
Could someone tell me if this limitation still exists in current versions?

I am attaching a screenshot in case I have not explained myself well, thank very much.

Muy buenas tardes a todos.
Hace unos meses que he montado un OPNsense en un microappliance de cuatro puertos, en el que actualmente utilizo uno para la wan, otro como troncal con varias vlans para una parte de la casa, y un tercer puerto conectado a un antiguo router que esta funcionando como switch y AP que no permite vlans.
El caso es que he adquirido un nuevo switch administrado y un AP para substituir el antiguo router y mi idea era "extender" las vlans ya existentes a esa parte de la casa. Quería hacerlo aprovechando el puerto que no utilizo y montar un lacp de 5GB, ya que se conectara todo el tráfico del AP, varios pcs y un NAS con un agregado de cuatro puertos dando diferentes servicios por varias vlans.
Todavía no me he liado con la agregación, pero al crear un bridge con las mismas vlans en diferentes puertos físicos no funciona.
En otro firewall que tenía los cuatro puertos estaban en el mismo switch y todas las vlans se "veían" y por defecto permitía todo el tráfico entre ellas, o se podía configurar para tener que permitirlo de manera explicita. Pero buscando información en el foro en ingles he encontrado un post de hace un par de años en el que se comenta que FreeBSD tiene esta limitación en su arquitectura y que no se pueden montar vlans encima de un bridge.
Alguien podría decirme si sigue existiendo esta limitación en la versión actual? Para seguir peleándome en esta linea si es que me he equivocado en alguna configuración, o directamente crear vlans diferenciadas.
Muchas gracias.