Messages

Thanks for reopening it, and for the pointers. The plugin is already close to what you describe: it has an interface setting and reloads Suricata on the newwanip event, and it covers both the IPv6 prefix and the WAN IPv4 /32. I'd rather not cut the IPv4 half, since rules that depend on Home networks need an accurate address, and it changes whenever the ISP changes it.

One question on the interface picker: do you mean a multi-select of internal interfaces whose prefixes get added?

If you or other maintainers would rather have this in core, I'm happy to answer questions or turn the plugin logic into a core PR.

Thanks, that's a useful pointer on Idassoc. A core version would need the same address-change hooks the plugin already uses, so it would be the same logic moved into core rather than a different approach. If it were in core, I think it should be opt-in, since it automatically changes what ends up in Home networks. The earlier core issues (core#6503 and core#3489) were closed, and the older one over concerns about service dependencies and restarts, so I went with an optional plugin that only reloads the rules.

Before I open a PR against core, I'd like to know whether a core maintainer would want this there as an opt-in option, or whether the plugin is the better home for it.

Thanks Cedrik. There have already been issues in core about this exact problem (core#6503 and core#3489), and both are closed. #6503 was closed by the bot for inactivity, and #3489 was closed over concerns about restarts and dependencies between the DHCP client and Suricata.

My plugin is meant as the remedy for those concerns, which is why I went this route instead of opening another core issue. It only reloads the rules and never restarts Suricata. #6503 was also tagged "help wanted" when the bot closed it, so I linked my plugin there.

Hi all,

I run OPNsense with Suricata in IPS mode on a residential ISP that hands out a delegated IPv6 prefix that changes. When it changes, the Home networks entry in Suricata goes stale, and I found it caused the same problem described in core#6503.

I wrote a small plugin for this, os-dynamic-homenet. It hooks the WAN address events (newwanip and updateip), updates only the Home networks entry it owns with the current delegated prefix and the WAN IPv4 /32, and then reloads Suricata's rules without restarting the engine. Settings are under Services > Intrusion Detection > Dynamic Home Network. There's an Enable box, an interface choice, and checkboxes to follow the IPv6 prefix and/or the IPv4 address.

It has been running on my router for over two weeks, through multiple natural prefix changes. The plugin updated HOME_NET and reloaded Suricata on its own each time. I first saw it on a live change on Oct 17. It's been on 26.7.6 through 26.7.8 with Suricata 8.0.7 and 8.0.8.

The repo is here: https://github.com/TBK27/os-dynamic-homenet
I've also opened a proposal for it upstream: https://github.com/opnsense/plugins/issues/5794

I'm hoping a maintainer can take a look at the proposal and tell me whether it fits as an official plugin. Feedback is welcome too if anyone has thoughts.