Recent Posts

71

Intrusion Detection and Prevention / Re: Suricata rule modifications via suricata-update

« Last post by jonny5 on Today at 08:14:13 am »

In short OPNSense's rule management has got me quite far... but I might be ready for a rather larger logic/control application.

See here:
https://suricata-update.readthedocs.io/en/latest/update.html#modifying-rules

https://suricata-update.readthedocs.io/en/latest/update.html#example-configuration-to-modify-rules-modify-conf

OPNSense has suricata-update already, and if we can safely mod away/quite the OPNSense SID management, and/or, somehow in-between-mod the rule set. Huge win! There are a few hosts that trip rules that if I could filter that rule away from that host, it would be the best win.

On a few rules replacing $HOME_NET with [$HOME_NET, ![192.168.0.20,192.168.0.21]] (for example) would make thing great ^_^

72

24.7 Production Series / Re: OpenVPN - Client specific overrides

« Last post by kozistan on Today at 08:09:11 am »

got it, 1st address server, 2nd broadcast so that's why +2

73

Intrusion Detection and Prevention / Re: Suricata rule modifications via suricata-update

« Last post by jonny5 on Today at 08:07:22 am »

If you were to make a file such as:

Code: [Select]

/usr/local/opnsense/service/conf/actions.d/actions_homelab.conf
You could add this code to it:

Code: [Select]

[configreload]                                                                 
command: /root/suricatamod.sh; exit 0                                           
parameters:                                                                     
type:script                                                                     
message:copy over and reload intrusion detection custom conf                   
description:Copy over and reload intrusion detection custom conf
The shell script would now be able to be scheduled by OPNSense's Web GUI Cron menu

Code: [Select]

/root/suricatamod.shFurther, let's say that script does a thing:

Code: [Select]

#!/bin/sh

# Get current date and time
TIMESTAMP=$(date +"%Y-%m-%d %H:%M:%S")

# Define file paths
ROOT_CUSTOM="/root/custom.yaml"
SURICATA_CUSTOM="/usr/local/etc/suricata/custom.yaml"
SURICATA_TEMPLATE="/usr/local/opnsense/service/templates/OPNsense/IDS/custom.yaml" # do not replace, breaks things
echo "$TIMESTAMP: Checking for configuration updates..." > /root/suricatasame.log

script_name="rule-updater.py"

# Check if the script is running using ps
ps aux | grep "$script_name" | grep -v grep > /dev/null

if [ $? -eq 0 ]; then
  echo "$TIMESTAMP: Script '$script_name' is already running." >> /root/suricatarestart.log
  exit 0 # Exit with a 0
else
  echo "$TIMESTAMP: Script '$script_name' is not running. Proceeding..." >> /root/suricatasame.log
fi

script_name="installRules.py"

# Check if the script is running using ps
ps aux | grep "$script_name" | grep -v grep > /dev/null

if [ $? -eq 0 ]; then
  echo "$TIMESTAMP: Script '$script_name' is already running." >> /root/suricatarestart.log
  exit 0 # Exit with a 0
else
  echo "$TIMESTAMP: Script '$script_name' is not running. Proceeding..." >> /root/suricatasame.log
fi

# Check if files are identical
if cmp -s "$ROOT_CUSTOM" "$SURICATA_CUSTOM"; then
  echo "$TIMESTAMP: Files are identical." >> suricatasame.log
else
  echo "$TIMESTAMP: Files are different, copying $ROOT_CUSTOM to $SURICATA_CUSTOM" >> /root/suricatarestart.log
  cp "$ROOT_CUSTOM" "$SURICATA_CUSTOM"
  # cp "$ROOT_CUSTOM" "$SURICATA_TEMPLATE"
  # Restart Suricata service (adjust command as needed for your system)
  service suricata restart
  echo "$TIMESTAMP: Suricata service restarted." >> /root/suricatarestart.log
fi

exit 0
Now, the result is you get a Suricata installation that can use a (and keeps using) very expressive custom.yaml file, such as this one where I have new vars address-groups and the like:
https://www.nova-labs.net/homelab-opnsense-crowdsec-multi-server/

74

24.7 Production Series / Re: Issue with UnboundDNS not answering DNS requests for local hostnames

« Last post by gyrex on Today at 07:45:48 am »

This sounds like the same issue: https://github.com/opnsense/core/issues/7376

and possibly this: https://github.com/opnsense/core/issues/6982

Also, apparently the registered leases should have entries in the

Code: [Select]

/var/unbound/dhcpleases.conf file, so I will check that next time the issue occurs.

I've created a new github issue here: https://github.com/opnsense/core/issues/8075

Can you please add to the issue so that the devs know it's not just one person experiencing this issue?

75

General Discussion / Re: I am having trouble with my DNS and NTP settings getting bypassed

« Last post by someone on Today at 07:15:39 am »

Thanks, its working with no wan firewall rules but defaults
That closes a security hole, thanks
I unchecked the box in unbound query forwarding to use system DNS servers
So it uses the settings in Query forwarding and DNS over TLS
Did a reboot
But it is using quad9 but still outgoing 53 instead of 853 to quad9, but works
thanks

76

24.7 Production Series / unable to delete alias

« Last post by defaultuserfoo on Today at 06:40:33 am »

Hi,

how do I get rid of an unused firewall alias that appears as still being referenced and can not be deleted?

When I try to delete it, I'm getting an info that a rule is still using it, but I deleted the rule and then deleted the whole interface the rule was used with.  There is no way that this alias should still be used in any way.

So far, I was only to disable the alias.  It's for a host and contains an IPv4 address.

77

General Discussion / Re: I am having trouble with my DNS and NTP settings getting bypassed

« Last post by someone on Today at 06:30:26 am »

I will try that
I think it wasnt working when I didnt open those ports but will try again
It hits outbound servers on those ports
 Inbound response is usually a high port number and covered by stateful firewall lets it in
Thanks I will definitely close that if I can
I will check the DHCP response
And the syn and rst packets response
I think ack is on the established port
And icmp
I will try it
thanks

78

24.7 Production Series / Re: DNS Over TLS Broken

« Last post by newsense on Today at 06:25:54 am »

So...service operational now ?

79

General Discussion / Re: I am having trouble with my DNS and NTP settings getting bypassed

« Last post by someone on Today at 06:25:02 am »

How I fixed it
I reloaded
Set unbound settings
Set DNS servers in system > general
Disabled firefox DNS
Is now working correctly so far
There were a few changes in unbound
Enable DNS sec support
I have listen port on 853 for quad9 but its using 53
Flush Dns cache on reboot
And aggressive nsec
enabled query forwarding for dns.quad9.net at 9.9.9.9
but at the top it is using the DNS servers I listed in system > general
8.8.8.8,8.8.4.4,9.9.9.9
Probably why quad9 is using 53 instead of 853
enabled DNS over TLS with dns.quad9.net also on port 853
also at the top shows DNS servers set in system > general
havnt changed it yet
also made snapshot
doing good so far even if using 53

80

Zenarmor (Sensei) / Re: Updating the packet engine resets web filtering to moderate

« Last post by IHK on Today at 06:19:14 am »

Can you share the logs and configuration by following the instructions in the link below so that we can make a detailed review?
I ask you to tick all the options.
 

https://www.zenarmor.com/docs/support/reporting-bug