Blocking port scans

[RChadwick]

While I don't run OPNsense, I used to run pfsense many years ago. I switched to Sophos UTM, mainly for security features like port scan blocking. However, it seems Sophos UTM is dead, and annoying bugs are driving me nuts (Like getting an email for EVERY port in a port scan attack. Hundreds of emails from Sophos is like a DOS attack in itself). Can OPNSense detect a Port Scan, and then block the IP address of the scanner? I heard this was possible with Snort an pfsense, but I'd like to stay away from pfsense for stability reasons.
Thanks!

[jclendineng]

pfsense does indeed support port scan blocking, as does opnsense.  The plugin you want for either firewall is called "suricata", and in the rulesets there is a category for scans that will detect port scans and block.

[RChadwick]

Thanks!
One quick question about OPNsense. The reason I left pfsense is that, while pfsense was rock solid, a few needed plugins were not, and would crash the entire router. I heard OPNsense doesn't have third party plugins. Is that true? If so, is that why?

[jclendineng]

What plugins? I had a few on pfsense and it was solid. Only reason I switched to opnsense was a more aggressive dev timeline.  Last pfsense release had terrible performance issues and would randomly hang due to a bug that was put in a future patch.  Opnsense has plugins, yes. Its the same base as pfsense (bsd) and as such can use ports.