Topics

16

General Discussion / nginx banned IP timer

« on: November 12, 2019, 12:32:27 pm »

is there an option to auto remove entries in the nginx ban table after a defined period? Should I define a cron job with "expiretable" command or something similar?

17

Intrusion Detection and Prevention / snort rules useless?

« on: November 12, 2019, 12:25:35 pm »

I never had a match on a snort rule despite having subscribed and having a LOT of them enabled
ET rules detect stuff, so suricata is working

Are snort rules so useless?

18

General Discussion / fw rule based on tcp options

« on: October 29, 2019, 08:19:37 pm »

is it possible to apply a filter rule based on tcp options? I saw there's the possibility to do that with tcp flags

I ask this since I saw a lot of syn flood comes with no options at all, since nowadays basically no one start a tcp handshacke without at least one of SACK, win scale, ECN, and such, it would be interesting to get rid of them

I tried the synproxie state type, but it's not a good choice in my opinion, I also limited number of SYN in a timewindows and it works quite well, issue is is so simple for a tool to change source address, making syn flooding too easy

19

General Discussion / banned ip still got forwarded by nginx

« on: October 27, 2019, 07:46:41 pm »

I have an IP banned by nginx (and suricata also detected and blocked an nmap fomr this ip) but packets still get forwarded to the backend, where I wisely put another protection level, but still how is this possible? Maybe I miss something on how ban works, I set the cron task every 10 minutes, IP ban was at 19:00 and at 19:30 still get IP request on my backend

20

General Discussion / nginx proxy buffer size

« on: October 26, 2019, 06:31:08 pm »

I set up CSP on my apache backend server, there's several hash inside so the headers become quite big, I have the need to customize the proxy buffer size in the location

    proxy_buffer_size          128k;
    proxy_buffers              4 256k;
    proxy_busy_buffers_size    256k;

Here where I found the solution:

https://ma.ttias.be/nginx-proxy-upstream-sent-big-header-reading-response-header-upstream/

21

General Discussion / nginx TLS >=1.2

« on: October 07, 2019, 03:14:59 pm »

is there a ways to force a minimum allowed TLS version?

EDIT: I saw there's the choise on the upstream, but I didn't see in the frontend server

22

General Discussion / IPS rules

« on: October 07, 2019, 07:54:32 am »

when I enable a ruleset, enable(drop filter) not all the rules are actually enabled, it that supposed to be work by design? meaning some rules are old or not so important so are disabled to reduce the workload?

thx

23

General Discussion / nginx headers

« on: October 05, 2019, 11:29:57 am »

would it be possible to edit

report-uri /opnsense-report-csp-violation

so that we don't reveal that we are using opnsense?
also the

server: nginx

is a bit disturbing, but I am not a web developer and maybe it's needed, I don't know, I am also aware that a nessus / openvas scan will probably detect nginx in any case, still I would avoid to send informations if not mandatory

content-encoding: gzip
content-length: 18770
content-security-policy: default-src 'self'; script-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com; media-src 'self'; font-src 'self' https://fonts.googleapis.com; form-action 'self';  report-uri /opnsense-report-csp-violation
content-type: text/html; charset=UTF-8
date: Sat, 05 Oct 2019 09:14:12 GMT
link: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
referrer-policy: same-origin
server: nginx
status: 200
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: sameorigin
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block

24

General Discussion / IPS IP ban

« on: October 04, 2019, 02:10:48 pm »

Is it possible, like the good nginx naxsi plugin does, to ban offending IP inside the suricata module?

25

General Discussion / nginxg logs are bad

« on: October 02, 2019, 06:31:51 pm »

I love OPNsense so much, but TBH nginx logs are terrible, for example

- they are not in reverse order, having the newest logs on top
- banned IP have epoch time format, which I have to execute a "date -d@xxxxxxxxxxx" on a linux to get a human readable value

I would love to have something like the really nice live view of the firewall log

Is it planned? Or am I missing something? (a plugin, or a setting somewhere)

Thanks and keep on the great work

26

General Discussion / tun interface ignored by OPNsense

« on: September 14, 2019, 06:46:28 pm »

Hello all,

this is my first post, I just got my new appliance and playing a bit with it.

I added, via command line a tun interface

/sbin/ifconfig tun2 create

and inserting it in a startup script, then restarted the appliance, I correctly see the interface

root@OPNsense:~ # ifconfig tun2
tun2: flags=8010<POINTOPOINT,MULTICAST> metric 0 mtu 1500
        options=80000<LINKSTATE>
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        groups: tun

but in the WUI I can't use it.

What I would like to achieve, even if probably silly, is to have a virtual internal network, not binded to any real nic, and be able to create firewall rules for that subnet. The idea is that I would like to have firewall between applications that run in the server itself.

Thanks for any suggestion

EDIT: I am able to see it under VLAN, so I added that tun interface and tagged as ID 100, now I can use it, looks like, but I strongly feel what I am doing is ridicously wrong LOL