Topics

Got this book from Apple iBooks about a week ago. Its an amazing resource and has become my goto source for anything OPNsource related.

Highly suggest it

Author:
Julio Cesar Bueno de Camargo

I have CrowdSec up and running on my OpnSense instance. My understanding is that CrowdSec is protecting my WebGUi service from Brute Force Attacks.

I had heard CrowdSec was going to release an IP blocklist of their own that OpnSense users could build an Alias for (ie Spamhaus). Ran into this on the CrowdSec website:

sudo apt install crowdsec-blocklist-mirror

Was wondering if I could Somehow build an alias? Any suggestions? It appears CrowdSec is maintaining a blocklist.

I welcome any comment/constructive critic/advice/correction below.

I love OpnSense

30 years sales experience in high tech, now retired. I am a privacy advocate and home networking is a hobby. My grandfather had his tractor he was always tinkering with, I am always tinkering with my home network.

OpnSense has become a very valuable tool for my home network.  I have sold most of these capabilities to the US Government at some point and now I have these capabilities at home via OpnSense!

I use the following as a guideline to protect my privacy. I not going to reveal what I use but I encourage when selecting a tech for each of the areas below beware, lots of vendors say they are private while in the background they still are collecting private info. (OpnSense and Sensei are wonderful tools to identify this)

Secure Browser (Brave is a joke!)
VPN (European provider, US VPN providers aren't protecting you)
Ad Blocker (OpnSense platform)
Password manager
Secure and encrypted messaging (Be very careful here)
Private Search Engine (What a mess)
Private email
Secure OS (Very hard to find and use)
Secure DNS (Need a static IP and your own DNS to be truly secure here)
Anti virus (shocking how much these vendors like to chat with your computer)

I struggled in the beginning in the following areas and struggled finding documentation. Most of the documentation I found assumed a certain level of understanding I did not possess, so I would have more questions than I started with.

Understanding IN/OUT (Not as easy at it sounds)
Source IP to Dest IP based on origination of connection
Which Interface to apply firewall rules
Inbound Interface
How to check FW rules
INSPECT button on rules page
How to use Alias
OpnSense documentation good place to start
How to use Floating Rules
had too find an example on a blog

As a home user what was I going to use OpnSense for?

I have 5 subnets:

Lab
IOT
Guest
Server
Open (No rules)

I want to isolate each subnet so I built rules for that.
I want to block access from certain countries (GeoIP Alias with floating rule)
I want to block IP's with bad reputations (Block list Alias with Floating rule)
I want to block malware (ClamAV)
I want to block Ads (I use Unbound DNS and Sensei)

I have tinkered with Suricata and CrowdSec. I use CrowdSec to protect the GUI. Got rid of Suricata.  I think its over kill for my home network. If CrowdSec ever releases a block list I will build an alias and floating rule for that as well

It has taken me almost 2 years to set this up. I am sharing this here in this forum because a guide for beginners/home users is needed. (I have thought of writing one myself but I am not qualified to)

Enterprises will use the Cisco's, Palo Alto, Fortinet, etc firewalls for their needs. OpnSense is great for a home user especially parents. However the learning curve is to steep.

I read this forum and get bits and pieces. Another suggestion is a Home User category here on this forum.

Please suggest, comment and criticize at will!

See Attachment


Whenever is install the Sensei repository PlugIn it orphans all of my other PlugIns. The sensei plug in never appears. I have to delete the Sensei PlugIn and then the other plugins return to normal.

Anyone else have this problem?

I installed the Crowdsec plugin manually on my opnsense firewall. I tested it and it works! However, I installed ver 1.3.2 and upgraded to 1.3.4.  Now the Plug In shows "Misconfigured" on the PlugIn page. I tested again and it seems to still be working. Dont understand the "MisConfigured" message

I keep getting this alert in my IDS:

Dest IP.             Port  Rule Message     
156.154.67.196   53   ET INFO Observed DNS Query to .biz TLD

I have rules in my firewall preventing external DNS queries yet this keeps getting through.  The rules are applied on all 3 LAN Ports and not on the WAN port.

I checked the IP address its a DNS server with no indications of having a bad reputation.  Is it possible the OPNSense firewall is sending random DNS Requests? I have no other explanation for this. I have watched the live firewall logs and may rules appear to be working.

Any information on this would be helpful

I am trying to learn how to use the Policy feature in Suricata on OpnSense.  Any guides anywhere?

[22.1.6]

I am running the current version of OPNSense: 22.1.6

I am running Suricata 6.0.4_1

I went to the Snort website and obtained an OINK Code

I go to: Intrusion Detection ==>Administration==>Downloads

I enter the OINK code and Rules file (snortrules-snapshot-29151.tar.gz, 29190 is the latest and I have tried that too)

The Plug In is installed: os-intrusion-detection-content-snort-vrt (installed)

I attempt to download the rules, however I get the message "Not Installed" under the Last Updated heading

What am I missing?