OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • English Forums »
  • Intrusion Detection and Prevention »
  • NOT Work for IPv6
« previous next »
  • Print
Pages: [1]

Author Topic: NOT Work for IPv6  (Read 6797 times)

abysscong

  • Newbie
  • *
  • Posts: 10
  • Karma: 0
    • View Profile
NOT Work for IPv6
« on: September 30, 2020, 08:18:06 am »
Hi all! First of all, I am very grateful to the opnsense software and the community, which brought me a lot of convenience in my work.

Recently I met a problem, having searched for days I haven't found the solution.

In 'Services: Intrusion Detection', Suricata rules work well for IPv4 traffic, e.g.
Code: [Select]
alert tls any any -> any any (msg:"test google"; tls_sni; content:"google.com"; nocase; priority:1; sid:51000000; rev:1;)It will drop google.com traffic (IPS mode).

But when it turns to IPv6 network, it doesn't work. (No drop, No log)
Code: [Select]
curl -6 -i https://google.com
HTTP/2 301
location: https://www.google.com/
content-type: text/html; charset=UTF-8
...
I also created a 'user defined' rule to test, such as blocking Destination IP '2001:4860:4860::8888', it works and logged the record, which shows IPv6 traffic has gone through the Intrusion Detection.

Any hint? Thanks very much!
« Last Edit: October 02, 2020, 10:07:05 am by abysscong »
Logged

abysscong

  • Newbie
  • *
  • Posts: 10
  • Karma: 0
    • View Profile
Re: IPS: Some Suricata rules doesn't work for IPv6
« Reply #1 on: September 30, 2020, 08:28:49 am »
It's opnsense 20.7.3 and suricata 5.0.3.
It's weird that I cannot find any info in neither opnsense web or suricata web and doc, perhaps it may be my own fault? So I come here for help :P
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6766
  • Karma: 494
    • View Profile
Re: IPS: Some Suricata rules doesn't work for IPv6
« Reply #2 on: September 30, 2020, 09:20:44 am »
Are you sure the rule is correct?
Can you do a packet capture if curl is really calling this SNI?
Logged
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

abysscong

  • Newbie
  • *
  • Posts: 10
  • Karma: 0
    • View Profile
Re: IPS: Some Suricata rules doesn't work for IPv6
« Reply #3 on: September 30, 2020, 03:02:27 pm »
Quote from: mimugmail on September 30, 2020, 09:20:44 am
Are you sure the rule is correct?
Can you do a packet capture if curl is really calling this SNI?
Thank you for your reply!
Sure the rule works.
Code: [Select]
curl -4 -i https://google.com
Code: [Select]
blocked LAN_0 10.1.0.40 53838 216.58.209.238 443 test google
Also curl -6 support SNI (reading package is a bit hard in my virtual env, so I use and another way to verify)

Code: [Select]
root@qwe:~# curl -k -I -6 --resolve google.com:443:[2404:6800:4005:810::200e] https://google.com/
HTTP/2 301
location: https://www.google.com/
content-type: text/html; charset=UTF-8
date: Wed, 30 Sep 2020 13:00:20 GMT
expires: Fri, 30 Oct 2020 13:00:20 GMT
cache-control: public, max-age=2592000
server: gws
content-length: 220
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

root@qwe:~# curl -k -I -6 --resolve youtube.com:443:[2404:6800:4005:810::200e] https://youtube.com/
HTTP/2 301
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 0
location: https://www.youtube.com/
date: Wed, 30 Sep 2020 13:00:31 GMT
content-type: text/html
server: YouTube Frontend Proxy
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
« Last Edit: September 30, 2020, 03:04:09 pm by abysscong »
Logged

abysscong

  • Newbie
  • *
  • Posts: 10
  • Karma: 0
    • View Profile
Re: IPS: Some Suricata rules doesn't work for IPv6
« Reply #4 on: September 30, 2020, 03:19:58 pm »
And it doesn't work for HTTP rule either.

Code: [Select]
alert http any any -> any any (msg:"HTTP google"; http.host; content:"google.com"; priority:1; sid:91000001; rev:1;)
Code: [Select]
root@qwe:~# curl -4 -i http://google.com
^C
Code: [Select]
blocked LAN_0 10.1.0.40 38848 216.58.209.238 80 HTTP google
Code: [Select]
root@qwe:~# curl -6 -i http://google.com
HTTP/1.1 301 Moved Permanently
Location: http://www.google.com/
Content-Type: text/html; charset=UTF-8
Date: Wed, 30 Sep 2020 13:16:54 GMT
Expires: Fri, 30 Oct 2020 13:16:54 GMT
Cache-Control: public, max-age=2592000
Server: gws
Content-Length: 219
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>

« Last Edit: September 30, 2020, 03:23:24 pm by abysscong »
Logged

abysscong

  • Newbie
  • *
  • Posts: 10
  • Karma: 0
    • View Profile
Re: IPS: Some Suricata rules doesn't work for IPv6
« Reply #5 on: October 02, 2020, 10:05:22 am »
Anyone solve this problem with me? :)
Logged

seed

  • Full Member
  • ***
  • Posts: 174
  • Karma: 12
    • View Profile
Re: NOT Work for IPv6
« Reply #6 on: October 13, 2020, 06:02:06 pm »
I experience the same issues. My custom ipv6 suricata block rule does not work either.
What can i do to debug this? May this be some kind of configuration issue.
Logged
i want all services to run with wirespeed and therefore run this dedicated hardware configuration:

AMD Ryzen 7 9700x
ASUS Pro B650M-CT-CSM
64GB DDR5 ECC (2x KSM56E46BD8KM-32HA)
Intel XL710-BM1
Intel i350-T4
2x SSD with ZFS mirror
PiKVM for remote maintenance

private user, no business use

mimugmail

  • Hero Member
  • *****
  • Posts: 6766
  • Karma: 494
    • View Profile
Re: NOT Work for IPv6
« Reply #7 on: October 14, 2020, 05:56:15 am »
Maybe ask in Suricata Forums top?
Logged
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

seed

  • Full Member
  • ***
  • Posts: 174
  • Karma: 12
    • View Profile
Re: NOT Work for IPv6
« Reply #8 on: October 14, 2020, 09:02:14 pm »
I found the solution (in my case).
My user rule was not fully loaded. After rebooting the router my user rule was loaded successfully and applied.
Problem solved for me.
Logged
i want all services to run with wirespeed and therefore run this dedicated hardware configuration:

AMD Ryzen 7 9700x
ASUS Pro B650M-CT-CSM
64GB DDR5 ECC (2x KSM56E46BD8KM-32HA)
Intel XL710-BM1
Intel i350-T4
2x SSD with ZFS mirror
PiKVM for remote maintenance

private user, no business use

abysscong

  • Newbie
  • *
  • Posts: 10
  • Karma: 0
    • View Profile
Re: NOT Work for IPv6
« Reply #9 on: October 17, 2020, 01:40:28 pm »
Thanks for your reply and feedback! @mimugmail @seed

Quote from: seed on October 14, 2020, 09:02:14 pm
I found the solution (in my case).
My user rule was not fully loaded. After rebooting the router my user rule was loaded successfully and applied.
Problem solved for me.
But in my case as you can see, the IPv4 traffic has been successfully blocked, which means the rule was loaded.
In your case I guess your rules are IPv6 address audit? Pure IPv6 address rules works for me too as I've declared before. :)
« Last Edit: October 17, 2020, 01:42:40 pm by abysscong »
Logged

abysscong

  • Newbie
  • *
  • Posts: 10
  • Karma: 0
    • View Profile
Re: NOT Work for IPv6
« Reply #10 on: October 17, 2020, 01:45:38 pm »
Quote from: mimugmail on October 14, 2020, 05:56:15 am
Maybe ask in Suricata Forums top?
Thanks! I have had another thread here but perhaps no progress. :P
https://forum.opnsense.org/index.php?topic=19358.0
Logged
  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • English Forums »
  • Intrusion Detection and Prevention »
  • NOT Work for IPv6
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2024 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy     | XHTML | RSS | WAP2