Messages

1

Tutorials and FAQs / Uploading Custom Suricata Rules with the GUI?

« on: November 18, 2024, 10:43:01 am »

Is there a way to upload custom Suricata rulesets using the GUI? At one point we use to be able to do this but it doesn't look like its availaible any longer. Here was an old way:

Step 1: Navigate to the Suricata Settings

    - In the OPNsense dashboard, go to Services > Intrusion Detection.
    - Click on the "Signatures" tab.

Step 2: Add Custom Suricata Rules

    - Scroll down to the "Local Rules" section.

 Here, you can add custom rules directly into the Suricata rule configuration:
 You can paste the contents of your custom rules into the box.
 Alternatively, you can specify a custom rule file location (more advanced).

2

Intrusion Detection and Prevention / Re: Intrusion Detection schdule tab broken

« on: September 02, 2024, 02:27:35 pm »

I have this same problem. It immediatly pops up with a new schedule creation. When clicking Cancel, it take you out of the schedule tab.

3

General Discussion / Plex Server Setup in 2024 - Fully accessible outside your network

« on: May 01, 2024, 09:54:49 am »

TO get your Plex server Fully accessible outside your network

Firewall -> Nat -> Port Forward
From this page click + (add)
No RDR: unchecked
Interface: WAN
TCP/IP Version: IPv4
Protocol: TCP
Source: Any
Source Port Range: any/any
Destination: WAN Address
Destination port range: (other) 32400/32400
Redirect target IP: Plex server internal IP
Redirect target port: (other) 32400
Pool Options: Default
Description: Plex Media Server
NAT Reflection: Enable
Filter Rule Association: Pass

Services-> Unbound DNS-> Advanced-> Private Domains-> plex.direct

Firewall-> Settings -> Advanced
Reflection for port forwards: checked
Reflection for 1:1: checked
Automatic outbound NAT for Reflection: checked
Firewall Optimization: normal

4

General Discussion / Cannot Brridge LAN & Wifi

« on: October 11, 2018, 08:12:30 pm »

Every time I follow these instructions to bridge my LAN & WIFI card I get this error:

Bridging a wireless interface is only possible in hostap mode.

How do I bridge Lan & Wifi?

Trying this: https://forum.opnsense.org/index.php?topic=5066.0
and this: https://www.cyberciti.biz/faq/howto-configure-wireless-bridge-access-point-in-pfsense/

Wifi card is a Dell DP/N: 0MX846.
https://www.pchub.com/uph/laptop/279-79033-1500/Dell-Common-Item-Dell-Wireless-LAN-Card.html

Also tried a Realtek RTL81878 MOW 11b/g and got the same error.

5

Intrusion Detection and Prevention / Whitelist IP address Blocked By Suricata

« on: August 24, 2018, 07:39:00 am »

I'm using Suricata IPS. It keeps blocking a single specific IP address with a rule. I would like to keep the rule in place just not block the single IP. What is the correct way to whitelist the IP address so it is not blocked with the Suricata IPS rule?

6

18.1 Legacy Series / Intrusion Detection - Rules Selection Bug/Annoyance

« on: February 22, 2018, 01:39:58 am »

Go to:  Services>Intrusion Detection>Administration>Rules

Browse past page 6 of rules, for the example.
Then click a box to enable any rule (furthest box on the right of rule).
This bring you back to page 1 automatically.

This is very annoying while browsing each page and trying to enable individual rules. You have to remember which page you are on to go back and continue where you left off. Enabling a rule should keep you on the same page you enabled the rule from.

7

Hardware and Performance / Re: wireless dropping?

« on: February 17, 2018, 02:09:04 am »

I have tried several WiFi cards And they all had issues. Instead of using the internal cards I flashed an old Linksys router with DDWRT firmware and used that as an access point. Since then I do not have wireless issues.

8

Hardware and Performance / Compatible WiFi Cards

« on: February 17, 2018, 02:04:58 am »

If you have a WiFi card installed in your Opnsense box please let us know what brand and model it is and its limitations you have encountered. Thanks!

9

General Discussion / Re: Best log viewer?

« on: December 09, 2017, 07:59:09 pm »

Can you describe how to set that up? Not as simple as installing a package 

10

17.1 Legacy Series / Re: 17.1.2 - Still have IDPS issues

« on: December 09, 2017, 07:49:34 pm »

I get a lot of these alerts:
SURICATA Applayer Detect protocol only one direction

Looking HERE it explains this:
Protocol detection only succeeded in one direction. For FTP and SMTP this is expected.
So if you have been using these protocols from your network then you will see these alerts.

11

General Discussion / Best log viewer?

« on: December 01, 2017, 05:28:31 am »

What is some of the best ways to view the Firewall & Suricata logs?
Any good plugins for this? Which one do you use? What are the benefits of your choice?

Thanks.

12

General Discussion / Transparent Filtering Bridge problem

« on: September 20, 2017, 07:23:57 pm »

I am trying to create a transparent filtering bridge.
My setup is: Internet-->Opnsense Filtering Bridge-->Router-->Lan
I followed these instructions: https://docs.opnsense.org/manual/how-tos/transparent_bridge.html?

Step 4. "Now Add an IP address to the interface that you would like to use to manage the bridge. Go to Interfaces -> OPT1 enable the interface and fill-in the ip/netmask." I think these instructions are outdated here. There is nowhere to enter the IP. I assume I can do this by going to Interfaces -> LAN & Interfaces -> OPT1, change the IPV4 configuration type to static and then set the IP address which I did to 192.168.1.3.

My Bridge OPT1 is 192.168.1.3
My Router is 192.168.1.1

I cannot access the Opnsense firewall any longer, but the bridge works.
Any ideas?

13

General Discussion / Cron GUI Bug

« on: August 29, 2017, 02:49:07 pm »

If you go to:
Services--> Intrusion Detection--> Schedule

It immediately defaults to a Edit Job option. I am unable to view the rest of the crons
or go to another cron to edit. The only way to edit or create another one would be to quickly
click on the edit icon or the + icon to add another cron before the screen goes back to the
Intrusion Detection settings page.

14

Tutorials and FAQs / Re: Redirecting all DNS Requests to Opnsense

« on: July 30, 2017, 01:46:32 pm »

Under: Firewall-->Rules-->LAN tab:

Rule 1 for DNS
http://imgur.com/a/t5uiZ

Rule 2 Block outbound LAN DNS queries
http://imgur.com/a/4pCKQ

15

Tutorials and FAQs / Re: Redirecting all DNS Requests to Opnsense

« on: July 28, 2017, 10:41:20 pm »

For anyone looking for the answer to this, I found it:
https://www.kirkg.us/posts/using-opendns-with-opnsense/
 

Particularly:
Rule#3 (Restricting other DNS on the Lan and redirecting it use OPNsense configured DNS)
If someone is trying to get around your OpenDNS filtering, and has changed their computer's DNS settings to use a public DNS server they will get denied.