pfSense Support Subscription

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - wgstarks

Pages: [1] 2 3 4 5
1
IDS/IPS / Re: How to add custom rules to Suricata
« on: January 11, 2018, 08:40:24 am »
Thanks. Wonder how many IP’s this hosting server has?😏

2
IDS/IPS / Suricate settings-which snort rules package?
« on: January 10, 2018, 08:51:05 am »
Did a little research regarding the use of snort rules packages in suricata. I found that any snort rules package should work with the exception that incompatible rules will just generate an error. Not sure what the best practice is though? Should i just use the rules for the most up to date version of snort? Or maybe its better to use an older version with better compatibility?

3
IDS/IPS / Re: How to add custom rules to Suricata
« on: January 09, 2018, 09:48:00 pm »
Thanks.

Is there a way to pass an FQDN or do I need to just list all their IP’s?

4
IDS/IPS / How to add custom rules to Suricata
« on: January 09, 2018, 09:07:52 pm »
I've found quite a few posts regarding syntax for custom rules but no discussion of how to actually add the rules. Is it as simple as pasting them into the Defined Custom Rules?

5
Packages / Re: Snort blocking all torrents
« on: January 08, 2018, 09:31:50 am »
It wasn’t checked. I verified it several times. After uninstalling the package the traffic is passing normally though, so it would seem that snort was responsible for blocking it. I was thinking that I must have misconfigured some other snort setting that caused this?

6
Packages / Snort blocking all torrents
« on: January 08, 2018, 08:36:12 am »
Recently installed Snort configured to not block any traffic (alerts only) and loaded the ET rules. Wanted to get an idea of what problems I would have with false positives. After a day or so I realized that snort actually was blocking torrent traffic. The only way I could find to pass the traffic was to uninstall the snort package. I’m sure this whole issue is probably due to ignorance on my part, so I’m looking for advice on how to install and test the package without any major disruptions to my network. Or maybe snort isn’t a good fit with torrents? Should I try some other package?

7
Firewalling / Re: Create a guest network with VLAN tag 1003
« on: January 03, 2018, 07:23:49 am »
Thanks. Actually, I understood that. Should have been more specific.

I can see that the default block rules aren’t going to do anything. If I move the any-any rule below them then it won’t do anything. Since I’m a noob at this, I’m not sure if I should modify the any-any rule or just delete the default block rules? My intent with this rule is to allow unlimited acces to the internet.

8
Firewalling / Re: Create a guest network with VLAN tag 1003
« on: January 03, 2018, 06:59:10 am »
Your Allow any rule will pass all traffic and nothing below it will have any effect.
Are you saying I should modify “allow any” or delete the rules below it? Or both?

9
Firewalling / Re: Create a guest network with VLAN tag 1003
« on: January 02, 2018, 06:50:47 pm »
Think I've got everything working now. Thanks @Derelict. Guest network has access to DHCP Server and WAN but no access to firewall or LAN (only other local network currently).

The firewall rules may need some tweaking. Any advice? I checked pinging, that works.




Edit: Caught my mistake with the "Block LAN Access" rule order. It's now one above "Allow Any".

10
Firewalling / Re: Create a guest network with VLAN tag 1003
« on: January 02, 2018, 12:02:23 pm »
I would disable those rules and add a pass any any rule. Does it work? Then you are not passing traffic you need to pass.
Thanks. Makes a lot of sense. Maybe one of these days I’ll learn to quit following these online step-by-step guides.🙄

11
Firewalling / Re: Create a guest network with VLAN tag 1003
« on: January 01, 2018, 08:22:40 pm »
Just because it's in a "guide" doesn't mean it's correct.

You only gave half the picture. What destination ports are you passing?

Not sure what you mean by destination ports?

Guess I'm a little slow tonight.:)






12
Firewalling / Re: Create a guest network with VLAN tag 1003
« on: January 01, 2018, 07:56:46 pm »
Just because it's in a "guide" doesn't mean it's correct.

You only gave half the picture. What destination ports are you passing?

Not sure what you mean by destination ports?

13
Firewalling / Re: Create a guest network with VLAN tag 1003
« on: January 01, 2018, 07:45:07 pm »
No way to know without knowing what that LOCAL_NETWORKS Alias and those port aliases are. Those rules don't make much sense.

What are you trying to do here?

I personally despise "blocking" traffic with pass ! rules. Hate it. Loathe it. Wish it would die in a fire.

If you want to block it, just block it. Then pass any.

local_subnets


These rules aren't mine really. Straight from a guide. Would be glad for any suggestions to simplify them.

As far as what I want to accomplish. I have 2 airports that are configured with a WPA2 “Home Network” which works and a “Guest Network” which shows “no internet”. I’m trying to setup a vlan that will allow guest connections to DHCP server and WAN only, without interfering with the “Home Network” which needs full access to local networks.

14
pfBlockerNG / Re: How to stop pfblockerNG from blocking sites??
« on: January 01, 2018, 05:26:27 pm »
After you have whitelisted a few sites in DNSBL, to settle things, run a Force Update DSNBL.
I tried that. The alerts tab showed that the sites were still being blocked and were also white listed. Even after running the update.

15
Firewalling / Re: Create a guest network with VLAN tag 1003
« on: January 01, 2018, 05:12:38 pm »
My understanding is the guest network on a airport will be tagged 1003.. You need to setup your switching and pfsense correctly to understand that tag..

https://www.thegeekpub.com/5191/use-airport-extreme-guest-network-bridge-mode/
The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANs
Thanks. I think I’ve kinda got my head wrapped around the basics of the tag routing now. Having a family day today, but I’ll give it a shot tomorrow and see if I can get it to work.

Thanks to everyone for your help so far.
Well that didn't turn out too good. I created a VLAN10 (pvid 10) on my switch with associated ports tagged. Created VLAN10_MAIN on my firewall for approved laptops and other wireless devices and created VLAN1003_Guest for guest use.


VLAN1003 should have no access to local network. Only internet. I believe that's working.




VLAN10 needs to have full access to the local network as well as the internet. I can get access to the internet but not the local network.



I'm hoping I've just missed a rule or misconfigured one?

Pages: [1] 2 3 4 5