Messages

1

General Discussion / Re: I am having trouble with my DNS and NTP settings getting bypassed

« on: Today at 07:15:39 am »

Thanks, its working with no wan firewall rules but defaults
That closes a security hole, thanks
I unchecked the box in unbound query forwarding to use system DNS servers
So it uses the settings in Query forwarding and DNS over TLS
Did a reboot
But it is using quad9 but still outgoing 53 instead of 853 to quad9, but works
thanks

2

General Discussion / Re: I am having trouble with my DNS and NTP settings getting bypassed

« on: Today at 06:30:26 am »

I will try that
I think it wasnt working when I didnt open those ports but will try again
It hits outbound servers on those ports
 Inbound response is usually a high port number and covered by stateful firewall lets it in
Thanks I will definitely close that if I can
I will check the DHCP response
And the syn and rst packets response
I think ack is on the established port
And icmp
I will try it
thanks

3

General Discussion / Re: I am having trouble with my DNS and NTP settings getting bypassed

« on: Today at 06:25:02 am »

How I fixed it
I reloaded
Set unbound settings
Set DNS servers in system > general
Disabled firefox DNS
Is now working correctly so far
There were a few changes in unbound
Enable DNS sec support
I have listen port on 853 for quad9 but its using 53
Flush Dns cache on reboot
And aggressive nsec
enabled query forwarding for dns.quad9.net at 9.9.9.9
but at the top it is using the DNS servers I listed in system > general
8.8.8.8,8.8.4.4,9.9.9.9
Probably why quad9 is using 53 instead of 853
enabled DNS over TLS with dns.quad9.net also on port 853
also at the top shows DNS servers set in system > general
havnt changed it yet
also made snapshot
doing good so far even if using 53

4

Intrusion Detection and Prevention / Re: If in IPS mode some of your sites may soon get blocked

« on: Today at 01:59:41 am »

Just a note
But if you dont want every social media site to know when you come online
And your using firefox
go to settings > home
and uncheck shortcuts
They are beacons

5

Intrusion Detection and Prevention / Re: Je ne recois pas d'alerte alors que les règles de suricata sont actif

« on: Today at 01:51:29 am »

Salut, ils corrigent un bug dans les règles, ce sera bientôt dans une mise à jour, ce qui est souvent le cas, il bloquera également kali s'il détecte son nom, et vous le verrez dans les logs

6

Intrusion Detection and Prevention / Re: Suricata rule modifications via suricata-update

« on: Today at 01:26:50 am »

You can download the rules , modify them, then put them back in opnsense, they will be overwritten when you do a rule update, so keep a copy. They are overwritten as a security measure which is very good.

7

Intrusion Detection and Prevention / Re: Constant DNS queries for opnsense.emergingthreats.net

« on: Today at 12:56:46 am »

Are you behind a IPS router
Did you reset it before you went online
When you load opnsense, download your rules and apply them, and make your changes
I would create a snapshot and click it to be active, so thats what will be booted on the next powerup
After changes I would make another snapshot
Are you capturing packets or looking at them or the traffic
Once you set your DNS servers and reboot, look for your DNS server IP
Does your IPS let you select your own DNS or have to use theirs
Make sure let ISP over ride your settings is unchecked
Are you using firefox
In the settings under privacy and security
At the bottom check use your own DNS servers
Do you have a ET schedule activated
I am not getting that traffic
But I was getting DNS bombs, not any more

8

Intrusion Detection and Prevention / If in IPS mode some of your sites may soon get blocked

« on: Today at 12:46:04 am »

Opnsense rulesets have started working
ET rulesets have not
They are working on it
When ET rulesets start working some of your favorite sites may be blocked
Many sites are blocked by rules, for instance
sid 2013504 will stop you from doing Ubuntu updates
sid 2100366 will stop you from doing any ping
There are social media blocking rules
If you use Kali linux you will get blocked
So
Before this happens in an upcoming update,
I just checked they are not working yet
Go to services > intrusion detection > administration > rules
In the search box type in facebook and you will see the rules
If thats a site you use you can disable them now, before the update
Find blocked sites by typing in their name or IP
Can also type their IP in alerts search box if they get blocked to find the rule blocking them
Can find an IP by googling it or on command line using $host google.com
it will give you some of googles IPs
they have many, just an example

They fixed opnsense rules very fast
Thing with ET rules is they are downloaded in a strict format to work with different parties and not just opnsense
I dont think opnsense wants to change them every update
So it may take some modification of suricata, or a program in opnsense to make them work
They are working on it
So I am letting you know before you get some sites blocked after a update
Which update I dont know
But now you are aware and know your system did not break, just check your rules

9

Intrusion Detection and Prevention / Re: The IDS rules management has a learning curve

« on: Today at 12:21:01 am »

policies depending on what is done will affect all rules under that policy
Policies are for large changes in ruleset behavior

10

Intrusion Detection and Prevention / Re: Constant DNS queries for opnsense.emergingthreats.net

« on: Today at 12:17:29 am »

Original question sounds like DNS or a misbehaving schedule possibly
Is your DNS sticking to its set IP
DNS settings in unbound
set your servers in system general
have the correct settings in unbound

11

Intrusion Detection and Prevention / Re: Can't download rules and enable IDS

« on: Today at 12:13:11 am »

at the top click to check all rules, all rules will get checkmark
At the top click on enable
With all rules enabled and with checkmarks then go to bottom and click download

12

Intrusion Detection and Prevention / Re: Suricata rule modifications via suricata-update

« on: Today at 12:06:16 am »

you cannot change the suricata yaml, it will be overwritten on reboot

13

Intrusion Detection and Prevention / Re: Suricata rule modifications via suricata-update

« on: Today at 12:04:18 am »

why are you not just using the rules updater

14

Intrusion Detection and Prevention / Re: Don't work suricata when enable ips

« on: Today at 12:02:35 am »

Which logs
Have you set up the rules

15

Intrusion Detection and Prevention / Re: IP Blocklists are not working in Suricata

« on: November 19, 2024, 01:54:20 am »

opnsense rulesets are now working, ET rulesets not yet