Messages

1

Development and Code Review / Re: Sensei on OPNsense - Application based filtering

« on: May 23, 2020, 10:06:40 pm »

Thx for the news about the netmap changes.

I disable the cache in pihole and still cannot see local resolved hostnames in sensei's reports.
Dns Crypt proxy is used though.
Can I change anything to resolve the hostnames or will you guys add an option update to handle this case?

Furthermore do you have a date for the update to automaticly impoert / update custom block lists like in pihole, etc?

Thx

2

Intrusion Detection and Prevention / Re: show total number of active drop and alert rules

« on: May 05, 2020, 11:19:40 am »

Perfect!
Thank you very much!

3

Intrusion Detection and Prevention / show total number of active drop and alert rules

« on: April 21, 2020, 09:52:48 am »

Hi there,

How can I list the total number of active drop and alert rules?
Is it possible in the gui or are there any commands for the shell.

Thx.

4

General Discussion / Re: Which one to go with for ad blocking and phishing sites

« on: April 15, 2020, 11:10:20 am »

I use a PiHole due to the fact that white and block lists are really easy to manage.
Sensei can block ads too but I prefer PiHole for this.
Easy to setup and maintain.

5

Development and Code Review / Re: Sensei on OPNsense - Application based filtering

« on: April 15, 2020, 11:01:05 am »

I really like sensei so far.
I’m using dnscrypt proxy and sensei cannot resolve local hostnames.
As mentioned a few weeks before, is their an option in the roadmap for sensei to have their own resolver?

6

Tutorials and FAQs / Re: HOWTO - DNS Security / Unbound DNS with DNSCrypt, DoH Plugin for IPv4 + IPv6

« on: December 08, 2019, 04:04:18 pm »

are you using pihole by any chance?
I have the same issue.

7

Development and Code Review / Re: Sensei on OPNsense - Application based filtering

« on: November 23, 2019, 08:20:39 pm »

Engine Version:    1.1_4    
App DB Version:    1.1.1    
Rules DB Version:    1.1.1    

Reports / Security

Code: [Select]

{
  "error": {
    "root_cause": [
      {
        "type": "index_not_found_exception",
        "reason": "no such index",
        "resource.type": "index_or_alias",
        "resource.id": "alert_all",
        "index_uuid": "_na_",
        "index": "alert_all"
      }
    ],
    "type": "index_not_found_exception",
    "reason": "no such index",
    "resource.type": "index_or_alias",
    "resource.id": "alert_all",
    "index_uuid": "_na_",
    "index": "alert_all"
  },
  "status": 404
}
Errors also occure at Reports / Web
Although I cannot open view erro message.

Furthermore since the update of sensei yesterday some sites aren't displayed fully with a running sensei.

8

19.7 Legacy Series / Re: kill states for multiple ips after block rule starts without using pfctl -F

« on: November 22, 2019, 06:52:06 pm »

But there is no alias field for cron jobs

9

19.7 Legacy Series / kill states for multiple ips after block rule starts without using pfctl -F

« on: November 19, 2019, 09:43:14 pm »

Hi there,

some ips in my network are blocked from the internet after a schedule kicks in.
There is also a cron job to kill all states to make sure that these clients cannot connect to the internet anymore.

Instead of killing all connections with pfctl -f state
I know that with pfctl -k 192.168.1.100 this ips states will be kicked.
How can kill states for several ips with 1 rule?
Or do I have to use an own rule for each ip I want to kick the states of?

10

Development and Code Review / Re: Sensei on OPNsense - Application based filtering

« on: November 19, 2019, 09:33:20 pm »

Thank you!

11

Development and Code Review / Re: Sensei on OPNsense - Application based filtering

« on: November 19, 2019, 09:31:47 pm »

and you can see resolved hostnames?

12

Development and Code Review / Re: DNSBL and additional features Plugin for Unbound

« on: November 19, 2019, 09:30:20 pm »

Will there be an option to search logs for blocked sites that a host wanted to visit like in pihole?
In pihole you can filter by blocked and allowed sites in the logs and also easily whitelist blocked sites.

13

Development and Code Review / Re: Sensei on OPNsense - Application based filtering

« on: November 19, 2019, 09:26:52 pm »

@sol, did a quick check on the time interval issue, and could not reproduce it. In which screen does this happen? With regard to dns, it's most probably due to sensei engine not being able to see dns transactions. See:

https://forum.opnsense.org/index.php?topic=9521.msg66123#msg66123

In all reports
I did update sensei engine to 1.1_ before I updated opnsense to 19.7.6 and had to do a reboot to make sensei work again.
Although the fixed intervals (15 mins, 1h, ...) show me actual data.

In regards of dns: is it maybe dnscrypt proxy which interfers here?

14

Development and Code Review / Re: Sensei on OPNsense - Application based filtering

« on: November 12, 2019, 07:49:32 pm »

Hi there,

I have a few questions:

Custom interval selection does not let me select any date later than August 7th although the selection of 24h, 7 days, 30 days in the drop down menu does work.

Furthermore show hostnames still keeps showing ip's only although this has been added to the reverse lookups. Opnsense shows hostnams in insight.

15

Development and Code Review / Re: Sensei on OPNsense - Application based filtering

« on: October 03, 2019, 01:49:39 pm »

And another question. How can I use sensei for my openvpn network. I cannot select it at the interface selection.

And local hostname resolution does not work for me or I'm not using the right configuration.
Opnsense runs unbound and dnscrypt proxy.

Which server do I have to use?
DNS server IP addresses to do reverse IP lookups:
127.0.0.1,192.168.1.1
is the current setup.