Messages

For me my rule is simple, a new rule in Rules [New] on the WAN interface coming in to pass all traffic and Divert-to set to Intrusion Detection. This basically replicates my previous setup by capturing all packets for inspection, I don't want it to be more granular, maybe in an enterprise environment but not my homelab. The order is up to you, place the rule accordingly based on your other rules for the WAN interface.

NOTE: Divert-to is hidden and is only available in the "Advanced Mode", so be sure to enable that in the top left corner of the new rule dialog.

I use the WAN interface and add my ISP routers IP address to Home Networks in the suricata config, as far as I am aware this is the best method when using an IPS. As when on the LAN interface you may get more false positives and a lack of detection's since that interface is on your internal network. Intrusion attempts come from the external network in most cases, especially for homelab environments.

https://docs.opnsense.org/manual/ips.html#general-setup
https://docs.opnsense.org/manual/ips.html#advanced-options

Be careful: a broad WAN "pass any + divert-to" rule will effectively allow all inbound traffic on WAN. That can expose services running on OPNsense itself (e.g. SSH, DNS, GUI) to the internet.

It likely makes more sense to apply divert-to only on the specific WAN allow rules / opened ports you actually intend to expose.

Thank you very much for this information!

For me my rule is simple, a new rule in Rules [New] on the WAN interface coming in to pass all traffic and Divert-to set to Intrusion Detection.

Will you need to set the rule direction to both? To capture outgoing traffic like malware calling home?

As when on the LAN interface you may get more false positives and a lack of detection's since that interface is on your internal network. Intrusion attempts come from the external network in most cases, especially for homelab environments.

And wouldn't you still detect external attacks if you only monitored within the LAN? At least all the traffic leaving the OPNsense router towards the LAN (traffic that gets through the firewall), which is presumably the majority of the data traffic?

Mein bisheriges Setup war wie folgt:

Damit ich die statische IP mittels DHCP von meinem Provider bekomme, habe ich am WAN ein VLAN getagged und am WAN Parent habe ich die MAC geändert.

Seit dem Update auf 26.1 bekomme ich aber nach einem Neustart erst mal die falsche IP bzw. Gateway. Wenn ich das Interface händisch reloade, funktioniert wieder alles. Sieht so aus, als würde eventuell die MAC nicht rechtzeitig gesetzt werden.

Bin mir nicht sicher, ob das Update daran schuld ist oder etwas anderes.

Lösung, welche ich entdeckt habe: MAC beim WAN Parent (igc1) und WAN (igc1_vlan31) einstellen oder beim WAN alleine mit Promisc Mode.

Was findet ihr als bessere Lösung? Hat es irgendwelche praktischen Nachteile, den Promisc Mode zu aktivieren?


Intel I226LM (igc)
XGS-PON ONT Modem am WAN Port