211
Intrusion Detection and Prevention / Re: Policy Suricata not working
« on: January 29, 2021, 03:37:07 am »
Clean install Opnsense. Rules: ET Telemetry
Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
212
Intrusion Detection and Prevention / Policy Suricata not working
« on: January 29, 2021, 03:20:17 am »
Opnsense 21.1
213
21.1 Legacy Series / Re: Suricata 6
« on: January 16, 2021, 08:23:07 pm »
Suricata is one of the best things Opnsense has and in my case it has always worked well. What you have to do is to have it configured correctly. In my case I have it acting in the wan and I can't be happier. The new version of Suricata seems to bring great changes adding better detection protocols and I hope they will integrate it in the new version of Opnsense. And if I have to compare pfsense ( mostly outdated ) - Snort ( gave me a lot of system blocking problems ) with Opnsense + Suricata the choice is safe: Opnsense
214
21.1 Legacy Series / Suricata 6
« on: January 13, 2021, 05:42:34 pm »
The notes of the new version of Opnsense do not say anything about the new version of Suricata. Is the update to Suricata 6.0.1 planned? Many thanks to the developers.
215
Zenarmor (Sensei) / Re: Sensei missing
« on: December 21, 2020, 05:30:49 pm »
Hello, thanks for the information. I explain. Sensei I had it installed earlier and uninstalled it. I have done the following to make it work. I have uninstalled Sensei. Then I accessed via SSH and looked for the folders you mention.
System: OPNsense 20.7.7_1-amd64
/usr/local/sense-db: Does not exist
/usr/local/datastore: Does not exist
If the following folders exist:
/usr/local/dbsensei
/usr/local/sensei
I have deleted those folders, restarted Opnsense, and reinstalled Sensei. Once Opnsense is restarted, when entering its configuration to start it, it gives me a mongodb error again. I have solved it by entering Opnsense through the console, uninstalling mongodb and re-urging it with these commands:
pkg remove mongodb40
pkg install mongodb40
Once this is done I have restarted Opnsense and when I reconfigured Sensei it has no longer given me a mongodb error and it works correctly. The funny thing is that both when reinstalling mongodb and when configuring Sensei (reinstall mongodb again) the following message appears:
This port is deprecated
It is scheduled to be removed on or after 2020-12-31 ( Attach screenshots )
Is there a future problem with this?
System: OPNsense 20.7.7_1-amd64
/usr/local/sense-db: Does not exist
/usr/local/datastore: Does not exist
If the following folders exist:
/usr/local/dbsensei
/usr/local/sensei
I have deleted those folders, restarted Opnsense, and reinstalled Sensei. Once Opnsense is restarted, when entering its configuration to start it, it gives me a mongodb error again. I have solved it by entering Opnsense through the console, uninstalling mongodb and re-urging it with these commands:
pkg remove mongodb40
pkg install mongodb40
Once this is done I have restarted Opnsense and when I reconfigured Sensei it has no longer given me a mongodb error and it works correctly. The funny thing is that both when reinstalling mongodb and when configuring Sensei (reinstall mongodb again) the following message appears:
This port is deprecated
It is scheduled to be removed on or after 2020-12-31 ( Attach screenshots )
Is there a future problem with this?
216
Zenarmor (Sensei) / Re: Sensei missing
« on: December 21, 2020, 03:11:36 pm »
I have managed to install it but when starting the configuration it gives an error.
217
Zenarmor (Sensei) / Sensei missing
« on: December 21, 2020, 02:39:15 pm »
New Sensei 1.6.2: https://www.sunnyvalley.io/post/sensei-1-6-2-for-opnsense-is-out/
Install Opnsense missing
Install Opnsense missing
218
Tutorials and FAQs / Re: HOWTO - DNS Security / Unbound DNS with DNSCrypt, DoH Plugin for IPv4 + IPv6
« on: December 11, 2020, 02:39:34 pm »219
Intrusion Detection and Prevention / Re: HOWTO - Advanced Settings Suricata
« on: November 28, 2020, 05:07:43 pm »
Updated configuration.
220
Intrusion Detection and Prevention / Re: Memory usage grow during a constant traffic flow
« on: November 28, 2020, 04:33:52 pm »221
General Discussion / Re: Grafana Dashboard for OPNSense and Sensei
« on: November 11, 2020, 04:32:47 pm »
Very nice and very interesting. The problem I see is that the installation is very complex. Could it be included by default in Opnsense?
222
20.7 Legacy Series / Re: Upgrade OPNsense 20.7.2 reboot fails due to suricata pid
« on: September 03, 2020, 04:39:02 pm »
Updated to 20.7.2 and everything works correctly.
223
20.7 Legacy Series / Re: [Solved] Upgrade to 20.7.2 WAN speed down to 10%
« on: September 03, 2020, 04:28:56 pm »
Updated to 20.7.2 and no problem
Interface intel igb0
Interface intel igb0
224
Intrusion Detection and Prevention / Re: FireHOL Block List ( Botnets, Attacks, Malware....)
« on: August 04, 2020, 05:00:01 pm »
Those lists don't seem to be updated every day. You can see it by accessing from the browser (modification dates - expiration dates):
- https://www.spamhaus.org/drop/edrop.txt
; Spamhaus EDROP List 2020/08/04 - (c) 2020 The Spamhaus Project
; https://www.spamhaus.org/drop/edrop.txt
; Last-Modified: Sat, 04 Jul 2020 01:32:55 GMT
; Expires: Wed, 05 Aug 2020 02:00:44 GMT
- https://www.spamhaus.org/drop/drop.txt
; Spamhaus DROP List 2020/08/04 - (c) 2020 The Spamhaus Project
; https://www.spamhaus.org/drop/drop.txt
; Last-Modified: Sat, 25 Jul 2020 08:39:55 GMT
; Expires: Tue, 04 Aug 2020 15:18:34 GMT
- https://www.spamhaus.org/drop/edrop.txt
; Spamhaus EDROP List 2020/08/04 - (c) 2020 The Spamhaus Project
; https://www.spamhaus.org/drop/edrop.txt
; Last-Modified: Sat, 04 Jul 2020 01:32:55 GMT
; Expires: Wed, 05 Aug 2020 02:00:44 GMT
- https://www.spamhaus.org/drop/drop.txt
; Spamhaus DROP List 2020/08/04 - (c) 2020 The Spamhaus Project
; https://www.spamhaus.org/drop/drop.txt
; Last-Modified: Sat, 25 Jul 2020 08:39:55 GMT
; Expires: Tue, 04 Aug 2020 15:18:34 GMT
225
Intrusion Detection and Prevention / Re: FireHOL Block List ( Botnets, Attacks, Malware....)
« on: August 01, 2020, 12:48:46 pm »New to opnsense, but I assume these FireHOL rules need to be moved to the top of the lists for both LAN and WAN?
Currently I have my GeoIP rules at the top, any concern there?
TIA
Effectively, that's right.