pfSense Gold Subscription

Author Topic: Quick Snort Setup Instructions for New Users  (Read 165983 times)

0 Members and 1 Guest are viewing this topic.

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3148
  • Karma: +816/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #30 on: October 17, 2013, 09:43:56 am »
Just another question:

If snort is bound to Interface WAN and pfsense is in transparent mode, how is snort working when blocking is activated?

does snort drop the packet and blocks the ip or is the packet passed and then the ip is blocked?

regards

karl

I honestly don't know the answer to that question.  I've never tested Snort on pfSense in Transparent Mode.  I suspect the traffic will still get blocked because Snort actually uses the packet filter engine and its tables to insert blocks.  In that sense it operates just like the firewall module itself.

Where Snort might get tripped up in Transparent Mode is with the defintion of $HOME_NET and $EXTERNAL_NET variables.

Bill

Offline sebna

  • Newbie
  • *
  • Posts: 24
  • Karma: +0/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #31 on: October 17, 2013, 05:21:45 pm »
Hi,

Thanks for great guide.

Before I found it I just went through all the options and configured as I thought it makes sense to my limited knowledge and I did one thing differently.

I went to my defined WAN interface in snort -> Wan Rules -> selected from drop down GPLv2 rules and pressed on enable all rules in the current category as they were all greyed out before that and seemed inactive - is this necessary step and what it actually means if I leave all of them greyed out and what it means if I enable them.

Also in point

20.  If you followed my advice for Snort VRT rules, this page is easy.  Just click the check box for "Use IPS Policy" and then select "Connectivity" in the drop-down.  Click Save and you're done!  Once you gain some experience with Snort, you can come back and choose one of the other two more restrictive policies.  I personally run "Balanced", but it will require some tuning if run in blocking mode.


If I only registered an account (without a paid subscription) to get access to GPL rules should I tick or leave the "Use IPS Policy" box unticked?

If I have mail server, DNS, DHCP and SQL server on my LAN should I define the names in WAN Variables and if yes what is the correct syntax? Can it be IP or is it a FQN

Thank you for explaining any of the above.

seb
« Last Edit: October 17, 2013, 05:24:10 pm by sebna »

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3148
  • Karma: +816/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #32 on: October 17, 2013, 09:17:14 pm »

I went to my defined WAN interface in snort -> Wan Rules -> selected from drop down GPLv2 rules and pressed on enable all rules in the current category as they were all greyed out before that and seemed inactive - is this necessary step and what it actually means if I leave all of them greyed out and what it means if I enable them.

Also in point

20.  If you followed my advice for Snort VRT rules, this page is easy.  Just click the check box for "Use IPS Policy" and then select "Connectivity" in the drop-down.  Click Save and you're done!  Once you gain some experience with Snort, you can come back and choose one of the other two more restrictive policies.  I personally run "Balanced", but it will require some tuning if run in blocking mode.


If I only registered an account (without a paid subscription) to get access to GPL rules should I tick or leave the "Use IPS Policy" box unticked?

If I have mail server, DNS, DHCP and SQL server on my LAN should I define the names in WAN Variables and if yes what is the correct syntax? Can it be IP or is it a FQN

Thank you for explaining any of the above.

seb

If you registered at Snort.org for the free account, that entitles you to the full Snort VRT rules download.  The only caveat is they are 30 days older than the rules the paid subscribers get.  As for the GPLv2 Community Rules, generally only a few of them will be enabled by default.  You can turn on the ones of interest to you.  If you don't want the headache of figuring out which Community Rules you want or need, then an easier approach in my view is to enable and use the Emerging Threats rules instead.  They stay pretty current and are arranged in categories that give clues as to what the rules are doing.

You can use the IPS Policy with the Snort VRT rules whether you have a paid or free account.  The only difference in paid versus free is the age of the rules.  As I mentioned, the paid subscribers get current updates.  The free account registered users get the new rules 30 days after the paid users.  It's a 30-day rolling sort of thing.  But the same IPS policies are available in both sets of rules.

If you have Mail, DNS and other specific servers on your network, you can certainly define their IP addresses for Snort. This makes Snort's job a bit easier.  By default, it assumes all the IP addresses in your network are all of the potential servers.  So this means it sort of inspects all traffic for all IPs for everything.  You can narrow this down by defining where some services are located (that is, which IP addresses host those services on your HOME_NET networks).  Armed with that information, Snort won't waste time looking for HTTP web exploits against a DNS or DHCP server.  It does this by matching the IP address in the target to the values you define in the variables.

To define servers or ports on the VARIABLES tab, you must first create a corresponding Alias under Firewall...Alias from the pfSense menu.  Type a descriptive name for the Alias, such as DNS_Servers, and then enter the IP addresses of all of your DNS servers.  Repeat the process to create Aliases for any other servers.  Now go to the VARIABLES tab in Snort and scroll down to the server description.  Start typing the name of the Alias you defined earlier.  It should auto-complete in the Alias form field.  Click SAVE when done.

« Last Edit: October 17, 2013, 09:19:55 pm by bmeeks »

Offline sebna

  • Newbie
  • *
  • Posts: 24
  • Karma: +0/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #33 on: October 18, 2013, 01:13:10 pm »
Thank you Bill,

It was late and I was tried yesterday :) I found the cause of the problem and basically I just need a restart for my OINK to work and to be able to download the definitions...

Thank you for clarifying other things and advice. Much appreciated as the whole guide :)

Seb

Offline coolcat1975

  • Jr. Member
  • **
  • Posts: 43
  • Karma: +0/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #34 on: October 18, 2013, 04:54:44 pm »
hi!

is it possible to run snort-inline?

actually if not then i wouldnt call it an IPS.

regards

Karl
« Last Edit: October 18, 2013, 05:26:09 pm by coolcat1975 »

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3148
  • Karma: +816/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #35 on: October 18, 2013, 07:39:02 pm »
hi!

is it possible to run snort-inline?

actually if not then i wouldnt call it an IPS.

regards

Karl

Snort is kinda-sorta "inline" on pfSense.  It can insert blocks into the firewall.  It is not 100% technically inline like it would be in a classic pure IPS.

Bill

Offline sebna

  • Newbie
  • *
  • Posts: 24
  • Karma: +0/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #36 on: October 19, 2013, 10:09:44 pm »
My SNORT will produce a lot alerts but only few blocks (ATM it runs only on WAN interface). Before adding pfblocker and running Snort in "Use IPS Policy" (I run it in security mode) it was blocking a lot more.

I dont have any custom whitelist and my Suppress contains only of google ip(s).

Any ideas?

Thanks


Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3148
  • Karma: +816/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #37 on: October 20, 2013, 09:53:09 am »
... Before adding pfblocker and running Snort in "Use IPS Policy" (I run it in security mode) it was blocking a lot more.

I dont have any custom whitelist and my Suppress contains only of google ip(s).

Any ideas?

Thanks

It could be that pfBlocker is preempting Snort and putting blocks in place.  I don't think the blocks of a particular IP address will be duplicated.

Also, you did not post the version of pfSense you are running.  If it is 2.1, then a problem with the filter_reload() function within that version of pfSense periodically clears the Snort block table.  So Snort is possibly blocking the IP, then the pfSense filter_reload() function comes along and clears the table.  When you look at the BLOCKED tab in Snort, it is actually reading the current entries from the snort2c block table that pfSense maintains.  The table may have been recently cleansed by the filter_reload() routine.

However, even considering the above, protection afforded by Snort is still there.  On the next offending packet from one of those formerly blocked IP addresses, Snort will insert a fresh block.

Bill

Offline godlyatheist

  • Jr. Member
  • **
  • Posts: 31
  • Karma: +0/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #38 on: November 22, 2013, 12:14:09 pm »
Thank you OP for the guide. I have some basic questions about setting up Snort. In the guide it said click the green arrow in the Snort column on the Interface tab so it turns red. But the tooltip says green is enabled and red is stopped, am I confused? Also, why does my Block column say DISABLED when though Snort is enabled?

Offline jflsakfja

  • Sr. Member
  • ****
  • Posts: 519
  • Karma: +70/-6
  • I don't know everything. I just RTFM.
    • View Profile
    • Need web hosting? Server management? Network Security?
Re: Quick Snort Setup Instructions for New Users
« Reply #39 on: November 22, 2013, 01:08:42 pm »
Thank you OP for the guide. I have some basic questions about setting up Snort. In the guide it said click the green arrow in the Snort column on the Interface tab so it turns red. But the tooltip says green is enabled and red is stopped, am I confused? Also, why does my Block column say DISABLED when though Snort is enabled?
The arrow color was recently changed to be more in "sync" with the rest of the interface. It used to be press the green to start, press the red to stop. The problem was that it showed a red arrow on the status tab while snort was running, which was different with all the rest of the interface (green means OK).
The reason it says that, is that we cannot change old posts on this forum.

To clarrify myself:
Green means snort IS running, you click it to STOP it.
Red means snort is NOT running, you click it to START it.
This post is my personal view and does not represent the view of my employer.

Demetris Demetriou aka jflsakfja

“well, it depends, if I’m in the mood, perhaps, now STFU, you didn’t pay for it, did you?” - A brother in arms.

Offline Mr. Jingles

  • Hero Member
  • *****
  • Posts: 1136
  • Karma: +92/-724
    • View Profile
    • The FreeBSD Foundation
Re: Quick Snort Setup Instructions for New Users
« Reply #40 on: November 23, 2013, 01:44:57 am »
Also, why does my Block column say DISABLED when though Snort is enabled?

Did you tell Snort to block offenders? (Interface -> block offenders).

Offline godlyatheist

  • Jr. Member
  • **
  • Posts: 31
  • Karma: +0/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #41 on: November 25, 2013, 10:49:58 am »
Also, why does my Block column say DISABLED when though Snort is enabled?

Did you tell Snort to block offenders? (Interface -> block offenders).
Now it says blocked, thank you.

Offline Mr. Jingles

  • Hero Member
  • *****
  • Posts: 1136
  • Karma: +92/-724
    • View Profile
    • The FreeBSD Foundation
Re: Quick Snort Setup Instructions for New Users
« Reply #42 on: November 25, 2013, 11:09:29 am »
Also, why does my Block column say DISABLED when though Snort is enabled?

Did you tell Snort to block offenders? (Interface -> block offenders).
Now it says blocked, thank you.

You're most welcome  ;D

Offline net125mp

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #43 on: January 30, 2014, 10:57:19 am »
I just wanted to thank you for this guide.  I just set up a PFSense install on an old Dell PowerEdge2850 server.  This helped me more than I can say.  The old network admins left no documentation behind, so when I had to rebuild PFS from scratch, I was a little out of my depth.  This certainly made setting up snort more than a little easier.  Especially since I really didn't even know where to start.  Thanks a million.

Offline edirob

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #44 on: February 07, 2014, 01:55:26 pm »
If anyone winds up without any blocked items over time in their Blocked tab despite loads of alerts, check your "Status: System logs: General" tab and look for any services reporting FILTER reloads or reconfigurations.  Since filter reloads cause the block table to clear, misconfigured or broken services can cause the Blocked tab to appear consistently empty.

Rob...