IDS + Haproxy + SSL decrypt

[klamath]

Howdy,

I just got finished up with converting the majority of my portforwards to haproxy terminated endpoints.  The SSL termination + re-encryption is taking place on my opnsense firewall.  I have IDS monitoring my external WAN connections, I was wondering if there is anything else i need to get setup to have IDS inspect the "in the clear" data while it is transversing the firewall?

Thanks

[Fright]

Hi
I do not think that scheme allows suricata to be used for analyzing https traffic. The decrypted traffic must somehow arrive on the interface the suricata is listening to for it to parse.
For IDS mode, this method might work: https://laskowski-tech.com/2020/03/29/opnsense-and-ssl-decryption-using-sslsplit/
For the IPS mode, I think you will need a chain of servers with intermediate servers between which unencrypted traffic will pass.

Nginx plugin uses naxsi WAF for web-traffic inspection (thanks @fabian for adding such a great feature)

[klamath]

This is disappointing, I get the issues with inspection around SSL and decrypting the traffic.  Is there any plans to getting a system in place to make SSL inspection on opnsense work in the future?  The more im digging into IDS/IPS is a non-starter on opnsense in the current state without fronting a CA cert or using unencrypted traffic on the backend.

[Fright]

May I ask why you prefer IDS over WAF for HTTPS-inspection?
There are clear limitations when running a reverse-proxy and IDS on the same host related to the layers at which the IDS and proxy is running. As a result, when IDS sees incoming web traffic, it is not yet decrypted, and when it sees outgoing traffic, it is already encrypted. and additional steps are required for the IDS to receive traffic suitable for analysis (and even more so for IPS).
WAF, on the other hand, was originally designed to analyze web-traffic on a reverse proxy.
I don't know about plans to integrate modsecurity and HAProxy, but OPN already has a excellent bundle of nginx+ naxsi and looking at the activity on github some updates can be expected

[klamath]

To be honest I have more experience with HAproxy so I used what I know.  I took the plunge today and setup nginx and running into nothing but problems with a Exchange server.  I have read a bunch of tickets around the issue and cannot find a place in the GUI to input such variables, I am hoping these options are there and I don't have to hand-jam them into a config.

Thanks,
Tim

https://forum.opnsense.org/index.php?topic=16595.0
https://forum.opnsense.org/index.php?topic=12939.0
https://stackoverflow.com/questions/14839712/nginx-reverse-proxy-passthrough-basic-authenication

[Fright]

can you start a new topic in "Web Proxy Filtering and Caching" with more details?

[klamath]

Understood and created.

https://forum.opnsense.org/index.php?topic=21154.0