Messages

136

Intrusion Detection and Prevention / Re: IDS/IPS Surciata fails to start when abuse.ch/URLhaus is activated

« on: August 31, 2018, 02:08:01 pm »

I have the same issue, basically running suricata kills my opnsense box, forcing a hard reboot.  Im working on a suricata server I can pass all traffic through.  Does not look like it was meant to be.  Pfsense has this same issue, but the rules are much much easier to add/remove/suppress.  My solution is to spin up another server running a dedicated IDS firewall such as simplewall/SELKS/bare metal suricata (or even pfsense just running suricata), and pass the data to another server running ELK stack.  So Modem > Opnsense Firewall > IDS > LAN with a failover bypassing the IDS in case it goes down, and for devices I do not need to worry about using VLANS.  Was hoping to pass data directly to my log server but my elk stack is using docker which means no real way to input opnsense data. 

137

Intrusion Detection and Prevention / Remote Log server

« on: August 27, 2018, 05:50:45 pm »

I have the elk stack on a remote server.  I cannot seem to get opnsense to forward traffic to it.  I was able to use barnyard2 with pfsense, do we have a feature that will allow remote log management?

138

General Discussion / PiHole DNS

« on: August 13, 2018, 02:45:53 pm »

I enabled unbound in forwarding mode, and it will forward to an upstream DNS server.  That works, but it is not forwarding hostnames.  I only see my opnsense ip in the forwarder even though I have enabled register hostnames in unbound.  Any idea why it is failing to pass hostnames? I have set hostname in DHCP for each host but it is not passing them.

139

18.7 Legacy Series / Re: Suricata enable Rules / Bug

« on: August 13, 2018, 02:35:39 pm »

There is something in the works, still very young, that will allow management of suricata.  I agree, right now its a mess.  No whitelisting/blacklisting, no rules suppression, and more importantly no way to manage the existing rules without going through thousands of lines.  Github repo is where you can follow the development.

140

Intrusion Detection and Prevention / Re: Aanval and OPNSense

« on: August 06, 2018, 02:40:38 pm »

Make sure your hardware supports it...no need to burden it if not.  Throw aanval in a vm/jail on another box.  That being said, I had aanval at one point, good stuff.  Next go around im going to be using elk stack though, if I can figure out how to pass suricata logs to a syslog server.

141

18.7 Legacy Series / Re: Google Domains DYNDNS

« on: August 01, 2018, 05:20:33 pm »

I see that! I guess I meant DNS validation for letsencrypt.  Sorry.  I do not know of any other way to validate subdomains that do not really have any way to validate.

142

18.7 Legacy Series / Google Domains DYNDNS

« on: July 31, 2018, 03:05:47 pm »

Any idea if it is possible to use Google Domains for dynamic DNS? I have all my domains through Google and it would be super handy to be able to update my IP automatically

143

General Discussion / Re: OPNsense versus pfSense

« on: July 27, 2018, 03:20:23 pm »

Used pfsense for a good while, and while it has many features, seemed to crash a lot with me.  Forums are a mess, but that's normal for BSD, as BSD gurus are usually quite arrogant.  I love BSD, use it a lot on my network, but my goodness.  This is about the only forum that seems respectful.  I installed opnsense after a rather bad week with pfsense and have not looked back.  Monowall was great and opnsense has been better for me in literally every way.  Highly recommend to everyone I come across.  Love the work being done, love the forums.  Sidenote, I prefer BSD over linux, just wouldn't recommend it for new users based on the points above.  Keep up the good work guys!

144

Intrusion Detection and Prevention / Suricata rules Managment

« on: July 05, 2018, 12:38:07 am »

First off new user from pfsense, this is absolutely awesome.  Like it way better.  Question: Are there plans to implement any form of rules management for suricata? Suppression, rules whitelist, etc. I can manually edit specific rules but when you have hundreds if not thousands of rules, it can become a bit time consuming