Messages

1

General Discussion / IGMP Proxy howto

« on: January 31, 2018, 11:21:38 pm »

Could someone clarify how to set up an IGMP proxy correctly? The information that I can find is very scarce and I have yet to come across a good tutorial that describes exactly how this works.

I have 2 interfaces in my OPNSense router (17.7.12):
- bce0 -> LAN with network 192.168.2.0/24
- bce0_vlan102 -> VLAN102 with network 192.168.10.0/24

The VLAN102 interface is meant for IOT stuff to roam free and get hacked
The LAN interface is my private LAN with some clients and servers.

Last week I got a Xiaomi mi home Aqara gateway, which sends it's data (besides to China) over multicast UDP packets on 224.0.0.50. This gateway is in VLAN102 with IP 192.168.10.111

But my home assistant service is running on my NAS which is in the LAN on 192.168.2.131

So if I put my laptop on a port on my switch which tags it as VLAN102, my laptop gets a 192.168.10.x/24 address, and I can see the multicast packets from the Aqara gateway in wireshark just fine.

To bring these packets onto the LAN network, I figured out I should be looking at IGMP PRoxy service, so I installed this package (os-igmp-proxy 1.3) on OPNSense, but I have really no idea how to configure it.

In the meantime I have tried most possible combinations of the following:
- Setting the LAN interface both as up- and downstream
- Setting the VLAN102 interface both as up- and downstream (inverse to the above, off course)
- Tried the following entries as 'Networks' in the proxy config: 224.0.0.50/32, 192.168.2.0/24 & 192.168.10.0/24

But in no situation I can get the packets coming from the Aqara gateway to appear on my LAN network.
I checked the firewall logfiles (I made temporary allow any rules between LAN <-> VLAN102) and nothing is being blocked

Is this just not working, or am I doing something wrong?
Any advise would be highly appreciated!

2

17.1 Legacy Series / IDS/IPS: Possible to save packets for later inspection?

« on: February 24, 2017, 10:20:30 am »

Hi everyone,

I just finished setting up OPNSense on my Dell Poweredge R210 II server, which is replacing my Asus RT-N66U which started having problem coping with my 230Mbit downlink I recently was upgraded to :-)
I was doubting for a long time whether I should go with PFSense or OPNSense, but now I have OPNSense I don't regret it at all.

One of my goals is to setup an IDS(/IPS) system to see if something funny is happening in my network. I did this a long time ago on a dedicated linux box using Snort. I don't remember the details of that setup I had back then, but I remember there was one option somewhere that allowed snort to save all network packets that triggered an IDS rule for x amount of time. This was quite useful because some rules do require some further investigation to decide whether it's something malicious or normal behaviour.

So my question is, is there an option like this somewhere in OPNSense/Suricata? I've setup IDS now and am getting some alerts I'd like to further investigate, but OPNSense only shows me the source and destination IP, which isn't always enough.