Messages

Hello,

I have a reverse proxy server running, and I've configured a DNAT rule to forward the WAN IP to the reverse proxy server's internal IP address.

The server is accessible from the internet on version 26.1, but it stopped working after upgrading. After reverting back to 26.1, everything works again.

At first, I thought the issue was related to the DNAT rule, but I discovered that the problem only occurs when "Divert to Intrusion Detection" is enabled. If I disable this option, everything works as expected.
(I have a manual firewall rule on the WAN interface that allows traffic to the reverse proxy server's internal IP address.)

There are no alerts shown in the Intrusion Detection logs. However, in the Live View I can see the traffic being marked as Allowed first, followed immediately by Blocked. Once I disable "Divert to Intrusion Detection", the Blocked entry no longer appears, and the reverse proxy becomes accessible again.

Am I missing something, or could this be a regression in the new version?

Kind regards

For me my rule is simple, a new rule in Rules [New] on the WAN interface coming in to pass all traffic and Divert-to set to Intrusion Detection. This basically replicates my previous setup by capturing all packets for inspection, I don't want it to be more granular, maybe in an enterprise environment but not my homelab. The order is up to you, place the rule accordingly based on your other rules for the WAN interface.

NOTE: Divert-to is hidden and is only available in the "Advanced Mode", so be sure to enable that in the top left corner of the new rule dialog.

I use the WAN interface and add my ISP routers IP address to Home Networks in the suricata config, as far as I am aware this is the best method when using an IPS. As when on the LAN interface you may get more false positives and a lack of detection's since that interface is on your internal network. Intrusion attempts come from the external network in most cases, especially for homelab environments.

https://docs.opnsense.org/manual/ips.html#general-setup
https://docs.opnsense.org/manual/ips.html#advanced-options

Be careful: a broad WAN "pass any + divert-to" rule will effectively allow all inbound traffic on WAN. That can expose services running on OPNsense itself (e.g. SSH, DNS, GUI) to the internet.

It likely makes more sense to apply divert-to only on the specific WAN allow rules / opened ports you actually intend to expose.

Thank you very much for this information!

For me my rule is simple, a new rule in Rules [New] on the WAN interface coming in to pass all traffic and Divert-to set to Intrusion Detection.

Will you need to set the rule direction to both? To capture outgoing traffic like malware calling home?

As when on the LAN interface you may get more false positives and a lack of detection's since that interface is on your internal network. Intrusion attempts come from the external network in most cases, especially for homelab environments.

And wouldn't you still detect external attacks if you only monitored within the LAN? At least all the traffic leaving the OPNsense router towards the LAN (traffic that gets through the firewall), which is presumably the majority of the data traffic?

Mein bisheriges Setup war wie folgt:

Damit ich die statische IP mittels DHCP von meinem Provider bekomme, habe ich am WAN ein VLAN getagged und am WAN Parent habe ich die MAC geändert.

Seit dem Update auf 26.1 bekomme ich aber nach einem Neustart erst mal die falsche IP bzw. Gateway. Wenn ich das Interface händisch reloade, funktioniert wieder alles. Sieht so aus, als würde eventuell die MAC nicht rechtzeitig gesetzt werden.

Bin mir nicht sicher, ob das Update daran schuld ist oder etwas anderes.

Lösung, welche ich entdeckt habe: MAC beim WAN Parent (igc1) und WAN (igc1_vlan31) einstellen oder beim WAN alleine mit Promisc Mode.

Was findet ihr als bessere Lösung? Hat es irgendwelche praktischen Nachteile, den Promisc Mode zu aktivieren?


Intel I226LM (igc)
XGS-PON ONT Modem am WAN Port