Thanks for the info.
I've been working working on this all night on and off.
My questions to you guys is, does files.pfsense.org and/or updates.pfsense.org
block bogon networks and if so, can I ask the update schedule? I ask because
the bogon list on a pfSense box connected to our
Have you tried pinging the IP from another machine not being routed
through your subnet?
On 9/29/2014 6:37 AM, Andrew Mitchell wrote:
Thanks for the info.
I've been working working on this all night on and off.
My questions to you guys is, does files.pfsense.org and/or
updates.pfsense.org
Yeah. Connects to both files.pfsense.org and updates.pfsense.org servers fine.
Drew
- Original Message -
From: Ryan Coleman ryan.cole...@cwis.biz
To: pfSense Support and Discussion Mailing List list@lists.pfsense.org
Sent: Monday, September 29, 2014 9:46:13 AM
Subject: Re:
Then I suspect that the issue is not in your network but a problem on
the software side.
On 9/29/2014 8:53 AM, Andrew Mitchell wrote:
Yeah. Connects to both files.pfsense.org and updates.pfsense.org
servers fine.
Drew
Of course you canIt's an add-on.
-Original Message-
From: List [mailto:list-boun...@lists.pfsense.org] On Behalf Of Roberto Carna
Sent: Monday, September 29, 2014 10:28 AM
To: list@lists.pfsense.org
Subject: [pfSense] Snort as IPS in Pfsense
Dear, I need to know if it's possible to
Use suricata
On Sep 29, 2014 2:27 PM, Roberto Carna robertocarn...@gmail.com wrote:
Dear, I need to know if it's possible to setup Pfsense with Snort to
get an IPS (Intrusion Prevention System), and in this case what is the
graphical interface used to view events and dropped traffic.
Thanks
Why Suricata in place of Snort?
Please can you tell me shortly the advantages of Suricata over Snort
Really thanks
Roberto
2014-09-29 14:37 GMT-03:00 Ivo Tonev i...@tonev.pro.br:
Use suricata
On Sep 29, 2014 2:27 PM, Roberto Carna robertocarn...@gmail.com wrote:
Dear, I need to know
I've forced an update on the firewalls for the bogon, list, that protect
files/updates.pfsense.org. This should resolve your issue.
On 9/29/2014 6:37 AM, Andrew Mitchell wrote:
Thanks for the info.
I've been working working on this all night on and off.
My questions to you guys is, does
Indeed it did.
Thanks,
Drew
- Original Message -
From: Jeremy Porter jpor...@electricsheepfencing.com
To: list@lists.pfsense.org
Sent: Monday, September 29, 2014 1:55:42 PM
Subject: Re: [pfSense] bogon networks
I've forced an update on the firewalls for the bogon, list, that
Dear Ivo and people, just three short questions:
1) Using Suricata, can I enable the IPS mode as I can using Snort ???
2) In IPS mode, do I have to have 3 interfaces in my server ???
3) The only way to view the IPS blocking events is from into Pfsense
or can I use Snorby ???
Thanks again,
You might want to use google insted og relying on others. Maybe try to do
your own homework?
Roberto
Here is a good place to start regarding Suricata or Snort.
http://www.linux.org/threads/suricata-the-snort-replacer-part-1-intro-install.4346/
---
Anastasios Stefos
*´αίέν άριστεύειν*
On Mon, Sep 29, 2014 at 2:34 PM, Roberto Carna robertocarn...@gmail.com
wrote:
Dear Ivo and
OK, thanks, the last please:
Do you recommend to install an IPS in a Virtual Machine like Vmware
??? Because we have VMweare for all our servers.
Regards,
2014-09-29 15:39 GMT-03:00 Anastasios Stefos anastasios.ste...@gmail.com:
Roberto
Here is a good place to start regarding Suricata or
If you have access to VMWare workstation installed or ESXi, it is
worthwhile to install and experiment in an isolated environment prior to
going live with either. If not, a couple of PC''s.
---
Anastasios Stefos
*´αίέν άριστεύειν*
On Mon, Sep 29, 2014 at 3:07 PM, Roberto Carna
Depends on what you want. A splitt design is normaly better and safer then
a all in one box. If you want suricata +snorby and barnyard its not
recommended to run it all on pfsense. There are many deps. that will cause
a security nightmare and you will probably run out of hw resources as well.
OK,
I agree completely with Espen. All your eggs in one basket is a terribly
bad idea and a troubleshooting nightmare.
Security Onion in back of pfsense is one idea. You can run Snorby, Snort
and additional tools and not overtax pfsense.
---
Anastasios Stefos
*´αίέν άριστεύειν*
On Mon, Sep 29,
Ok, and do you recommend to setup the Pfsense WAN and LAN interfaces
in bridge mode with firewall rules enabled ???
Really thanks,
Roberto
2014-09-29 16:15 GMT-03:00 Espen Johansen pfse...@gmail.com:
Depends on what you want. A splitt design is normaly better and safer then a
all in one
Why bridge? Do you want to hide evrything? Its not that hard to fingerprint
a pfS bridge. If you have practical reasons, sure go ahead.
29. sep. 2014 21:28 skrev Roberto Carna robertocarn...@gmail.com
følgende:
Ok, and do you recommend to setup the Pfsense WAN and LAN interfaces
in bridge mode
Mainly bridge to hide the IPS server from Internet, and also if I
don't use the bridge mode I have to put a public IP in the WAN
interface connected to the router and I have not much more available
public IP's.
2014-09-29 16:31 GMT-03:00 Espen Johansen pfse...@gmail.com:
Why bridge? Do you want
You can use as many interfacez you want.
You can use the web gui or tail -f the file on
/var/log/suricata/(interface)/*
:)
On Sep 29, 2014 3:34 PM, Roberto Carna robertocarn...@gmail.com wrote:
Dear Ivo and people, just three short questions:
1) Using Suricata, can I enable the IPS mode as I
Ivo, I want to locate the IPS between the router and the corporative
firewall, so I think to use bridge modeis correct???
2014-09-29 16:34 GMT-03:00 Ivo Tonev i...@tonev.pro.br:
I recomend to use in router mode.
On Sep 29, 2014 4:29 PM, Roberto Carna robertocarn...@gmail.com wrote:
Ok,
You can use invalid IP on wan interface. This way is no way to avoid the
firewall.
On Sep 29, 2014 4:37 PM, Roberto Carna robertocarn...@gmail.com wrote:
Mainly bridge to hide the IPS server from Internet, and also if I
don't use the bridge mode I have to put a public IP in the WAN
interface
If all you want is a IPS then i dont undertand what you need pfS for?
There are tons of setup guides for a linux flavour of choice to get this
setup done. You can even build a hogwash like setup if you like.
29. sep. 2014 21:38 skrev Roberto Carna robertocarn...@gmail.com
følgende:
Ivo, I want
On pfsense is clickgo. No need to install everything. :)
On Sep 29, 2014 4:46 PM, Espen Johansen pfse...@gmail.com wrote:
If all you want is a IPS then i dont undertand what you need pfS for?
There are tons of setup guides for a linux flavour of choice to get this
setup done. You can even
Ok, thanks
2014-09-29 16:58 GMT-03:00 Ivo Tonev i...@tonev.pro.br:
On pfsense is clickgo. No need to install everything. :)
On Sep 29, 2014 4:46 PM, Espen Johansen pfse...@gmail.com wrote:
If all you want is a IPS then i dont undertand what you need pfS for?
There are tons of setup guides
Dear, this topic is very interesting to me...I have the same scenario:
Internet Router --- PFsense Corporate Firewall
1) Is it possible to have just 2 interfaces in Pfsense in order to setup an
IPS ???
2) Isn't it the best way to setup a bridged firewall ad Roberto said ???
Because I need
Here is a good place to start regarding Suricata or Snort.
http://www.linux.org/threads/suricata-the-snort-replacer-part-1-intro-install.4346/
Is the free to use version of Snort going away? I scanned the page mentioned
above but it seems unclear.
Suricata sounds like an excellent
Dear, do I have to have 3 network interfaces or 2 interfaces are enough to
implement the IPS??? Because I think I'll have 1 promiscuos WAN, 1
promiscuos LAN and 1 management.
The Pfsense firewall has to be setup as BRIDGE if want to put it between
the router and the corporate firewall ???
I don't like the bridge approach because if you have many vlans it become
very complicated.
I always use the router approach because I can configure the IDS for one
interface and IPS for another.
If you don't have enough IP addresses, you can use invalid IP on firewall
WAN and create a route on
Kickstarter had/has a campaign by iguardian to create a snort appliance. It
looks like something you are trying to do. Instead of pf, it is based on
openwrt. Check it out.
Yudhvir
On Sep 29, 2014, at 4:22 PM, Ivo Tonev i...@tonev.pro.br wrote:
I don't like the bridge approach because if
The Pfsense firewall has to be setup as BRIDGE if want to put it between the
router and the corporate firewall ???
Connect like this?
www - isp router - pfSense - corporate firewall - lan
Don’t think you have to use bridge mode. Can Snort work in bridge mode?
But you say: one interface for WAN, a second for
LAN...and which interface is for managing ???
You manage with a browser from LAN, and optional also from the WAN port. And
with ssh from the LAN.
___
List mailing list
List@lists.pfsense.org
do I have to have 3 network interfaces or 2 interfaces are enough to
implement the IPS?
With Snort, just need one for wan, one for lan. That’s all. I use a 3rd for
wifi at home.
The office is a virtual machine with two wan ports, one lan, one wifi, and one
connection for the host.
In production environment you need 3 interfaces - one for WAN, one for LAN
and one for management.
http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/ips/ips_qsg
.html
On Mon, Sep 29, 2014 at 9:24 PM, compdoc comp...@hotrodpc.com wrote:
But you say: one interface for WAN, a second
Correct, as you said:
www - ISP router - pfSense - corporate firewall - Lan
I have one public IP in the router interface, another public IP en the
corparate firewall interface, and I can't change these parameters at all, I
need to put the IPS in the middleso I think I have to use the bridge
OK Ivo, this is very helpful to meSuppose I have:
Router / IP 200.1.1.1 --- WAN/pFsense/LAN --- Firewall / IP 200.1.1.2
I have to maintan invariable the addressing of this scenario, so what IP
addresses do I have to assign to WAN and LAN pFsense interfaces ???
Thanks a lot,
JeLo
On Mon,
I can say that I imagine this addresses space:
Router / IP 200.1.1.1 --- WAN IP-Less / pFsense/ LAN IP-Less --- Firewall /
IP 200.1.1.2
OPT1 / IP
200.1.1.3
(management)
So, the
I think this is good for us:
- Router ISP with IP 200.0.0.1
- pFsense with the following interfaces:
a) WAN IP-Less
b) LAN IP-Less
c) OPT1 with IP 200.0.0.2 (management)
d) Bridge with WAN and LAN interfaces, and Bridge interface IP-Less
- Corporate firewall with IP 200.0.0.3
- Snort
I see no keyword match for Bro IDS nor Cymru from the previous 34
messages.
https://github.com/sethhall/bro-scripts/wiki/The-Malware-Hash-Registry-and-Bro-IDS
https://www.bro.org/
2c
--
Blake Cornell
CTO, Integris Security LLC
501 Franklin Ave, Suite 200
Garden City, NY 11530 USA
39 matches
Mail list logo