pfSense Support Subscription

Author Topic: Quick Snort Setup Instructions for New Users  (Read 166358 times)

0 Members and 1 Guest are viewing this topic.

Offline DiskWizard

  • Full Member
  • ***
  • Posts: 126
  • Karma: +4/-2
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #45 on: February 10, 2014, 10:28:18 am »
Good day !
I have 2 WAN Interfaces and was trying to set up rules according to this forum. Making a setup for 1 interface took me around 1,5 hour. The question is - Is there any facility to simply copy the ruleset between interfaces ?
Thank you in advance.
1) GA-N3150M-D3P 8Gb RAM

2) GA-C1037EN-EU 4GB RAM
+ 2,5 SATA III Solid State Drive SLIM S60

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3173
  • Karma: +821/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #46 on: February 12, 2014, 09:34:17 am »
Good day !
I have 2 WAN Interfaces and was trying to set up rules according to this forum. Making a setup for 1 interface took me around 1,5 hour. The question is - Is there any facility to simply copy the ruleset between interfaces ?
Thank you in advance.

Not currently, but another user requested something similar.  I have that sort of feature on my TODO list.  I was thinking along the lines of being able to create "templates" with rules, preprocessors, variables, and some other parameters all configurable.  You could save and name the templates, then apply one to any interface on demand.  Would that work for you?

Bill

Offline Trel

  • Sr. Member
  • ****
  • Posts: 368
  • Karma: +11/-1
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #47 on: February 12, 2014, 01:34:43 pm »
I have the community rules box checked, but when I go to the tab to update, the button is greyed out.  Am I doing something wrong?  If I select the emerging threat box, I am able to click the update button, but with just community rules checked, I am not.

Offline DiskWizard

  • Full Member
  • ***
  • Posts: 126
  • Karma: +4/-2
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #48 on: February 12, 2014, 04:53:43 pm »
Thank you beemks ! Yes, I think it worked for me. Does it means what Snort consider Autogenerated Supress list as "top list" ?
1) GA-N3150M-D3P 8Gb RAM

2) GA-C1037EN-EU 4GB RAM
+ 2,5 SATA III Solid State Drive SLIM S60

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3173
  • Karma: +821/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #49 on: February 15, 2014, 09:02:43 am »
Thank you beemks ! Yes, I think it worked for me. Does it means what Snort consider Autogenerated Supress list as "top list" ?

The auto-generated list will have the name of the interface followed by a random number (UUID).

Bill

Offline Ramosel

  • Full Member
  • ***
  • Posts: 216
  • Karma: +15/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #50 on: February 21, 2014, 08:49:04 am »
I don't want to discount Bill's efforts on this thread.  It is absolutely the best place to start.

That said, I've recently introduced pfSense and the Snort package to a few friends who are long time, big time, professional security hawks looking for a solution at home a bit more elegant than running generations old (but affordable) dedicated firewall hardware.  I believe the best "find" I have come across and directed my friends to is the "fine tuning" post started by user "jflsakfja" as this thread:

https://forum.pfsense.org/index.php/topic,64674.0.html

This user requested the ability some time ago at the start of that thread to be able to edit his post in this sticky rather than having to continuously add to an existing thread.  I, for one, would like this be reconsidered by the mods as the above thread is slowly being buried as time passes.   I can only surmise the lack of updates as anticipated by "jflsakfja" could be because of a lack of response (evidenced by lack of edits here as of this date) to that request.   Or perhaps because I've pushed him/her for more information...?  If not at least maybe this post can serve as a jump point for folks looking for or could benefit from that information.   

I'd like to see his/her updates continue as the schema introduced by this user may not be the absolute best way of setting up Snort and pfBlocker but its the best I've come across and certainly has made my system more efficient and less troublesome.   Judging by recent posts in the Packages area, it seems many others could benefit from this schema as well.... if they knew about it.

Respectfully submitted,
Rick

Offline joako

  • Full Member
  • ***
  • Posts: 162
  • Karma: +3/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #51 on: February 26, 2014, 12:18:37 pm »
Is there any way to log the packets that trigger a snort alert? Mainly I want to see HTTP header and request associated with the alert.

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3173
  • Karma: +821/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #52 on: March 02, 2014, 10:03:56 am »
Is there any way to log the packets that trigger a snort alert? Mainly I want to see HTTP header and request associated with the alert.

The new 2.9.6.0 version of Snort offers increased packet/file capture abilities according to the post on the Snort.org web site.  I am working now on readying that version for the next Snort package update.  I will investigate what is offered in the new binary and see what I can reasonably incorporate into the GUI.

I had a similar request from some folks in the new Suricata BETA package thread where the wish was a clickable link from the alert on the ALERTS tab to a view of the packets that triggered the alert.  I am mulling over in my head the best way to accomplish that without bogging down the firewall CPU searching through hundreds of megabytes of packet capture files.  In general its better to offload such tasks to an external system.

Bill

Offline Melphiz

  • Jr. Member
  • **
  • Posts: 37
  • Karma: +0/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #53 on: March 11, 2014, 08:02:41 am »
The Missing Part to Quick Snort Setup Instructions for New Users


In tab "Rules", under "Category" select:
(--- means blank table at time of writing)

Hello,

does this mean I have to enable ALL when it's written all? Jesus, that would take ages as you can only enable one at a time ... Especially GPLv2 has like 85% disabled by default ... Holy, I have 3x WAN, I'd never find the time for that.

I don't really understand enabled/disabled here. For your example with "2000419" (which occurs right after I started snort with default settings) the rule is faded/greyed out - means it is disabled by default, right? So why does it generate an alert?

Edit: Whoa I couldn't use that whole package for 3x WAN, it uses 42% of 2027 MB for 1 WAN already o.O
« Last Edit: March 11, 2014, 08:10:40 am by Melphiz »

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3173
  • Karma: +821/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #54 on: March 11, 2014, 08:19:18 pm »
The Missing Part to Quick Snort Setup Instructions for New Users


In tab "Rules", under "Category" select:
(--- means blank table at time of writing)

Hello,

does this mean I have to enable ALL when it's written all? Jesus, that would take ages as you can only enable one at a time ... Especially GPLv2 has like 85% disabled by default ... Holy, I have 3x WAN, I'd never find the time for that.

I don't really understand enabled/disabled here. For your example with "2000419" (which occurs right after I started snort with default settings) the rule is faded/greyed out - means it is disabled by default, right? So why does it generate an alert?

Edit: Whoa I couldn't use that whole package for 3x WAN, it uses 42% of 2027 MB for 1 WAN already o.O

There is an "Enable All Rules in the Current Category" button on the RULES tab for a Snort interface.  So select the GPLv2 Community Rules in the drop-down, then click the "Enable All Rules in the Current Category" button (it is a plus "+" icon).

The answer to your second question about a "disabled rule" apparently causing an alert is as follows.  Many Snort rules either fire, or look for previously fired, internal triggers called flowbits.  Google the terms "snort flowbits" to find some web sites with more detailed explanations.  In order for some rules to fire an alert, they need to see flowbits set by some other rules.  The Auto-Flowbits feature of Snort will walk through all of your enabled rules looking any flowbit dependencies.  If it finds a needed flowbit is only set by a currently disabled rule, then it will auto-enable that rule (unless you have explicitly manually disabled it).  So the short answer is the alert is coming from a rule that the auto-flowbits process toggled from "default disabled" to "default enabled" behind the scenes.  If you really do not want an alert for that rule, simply add it's GID:SID to the Suppression List.

Bill

Offline cogumel0

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +3/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #55 on: March 22, 2014, 04:33:33 pm »
Hi Bill,

You said in a couple of your posts that to work around NAT and knowing the origin of an internal threat you'd also enable snort on the LAN interface.

You suggested leaving snort also looking at the WAN interface but with a lot less rules than the LAN and handling everything else on the LAN (I'm assuming you also mean setting both WAN and LAN snort configurations to look at both source and destination).

I can understand the logic of moving it to the LAN since otherwise in a NAT environment you can't see which client is generating threat alerts, but what is the reason behind leaving some of the rules on the WAN and not moving everything to the LAN?

Also another question: my pfSense setup consists of 3 LANs, if I were to setup snort with the vast majority/all the rules on the LAN, would I need to have one setup for each interface? Which in turn would mean 3x as much RAM usage, and manually setting each of the interfaces manually? Is there one way to apply the same config to all LANs through without the increase in memory?

**EDIT**

Forgot to say my pfSense is a VM running on ESXi 5.5 Update 1, so is this something I can change by configuring promiscuous mode on the VM network?

Thank you.
« Last Edit: March 22, 2014, 04:36:57 pm by cogumel0 »

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3173
  • Karma: +821/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #56 on: March 23, 2014, 08:52:13 am »
Hi Bill,

You said in a couple of your posts that to work around NAT and knowing the origin of an internal threat you'd also enable snort on the LAN interface.

You suggested leaving snort also looking at the WAN interface but with a lot less rules than the LAN and handling everything else on the LAN (I'm assuming you also mean setting both WAN and LAN snort configurations to look at both source and destination).

I can understand the logic of moving it to the LAN since otherwise in a NAT environment you can't see which client is generating threat alerts, but what is the reason behind leaving some of the rules on the WAN and not moving everything to the LAN?

Also another question: my pfSense setup consists of 3 LANs, if I were to setup snort with the vast majority/all the rules on the LAN, would I need to have one setup for each interface? Which in turn would mean 3x as much RAM usage, and manually setting each of the interfaces manually? Is there one way to apply the same config to all LANs through without the increase in memory?

**EDIT**

Forgot to say my pfSense is a VM running on ESXi 5.5 Update 1, so is this something I can change by configuring promiscuous mode on the VM network?

Thank you.

It is true there is no necessary technical advantage running Snort with split rules (some on WAN and most on LAN, for example).  It is more of a preference thing.  Depends primarily on the network design you have and what you want to protect in what ways.

As for a VMware environment with multiple LANs, I don't know of a way short of running Snort on each LAN interface.  I have not, though, played with promiscuous mode in VMware.  I don't know if that would be a solution or not.

Bill

Offline cogumel0

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +3/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #57 on: March 23, 2014, 09:33:05 am »
Well I'm torn between the two setups in my case.

If I set it up on the WAN, I only need to set it up once and it will work for all interfaces. However I lose the ability to see which client generated the alert or, in my case, which LAN it came from which makes it even harder. Also I lose the ability to have different per LAN settings

If I set it up on the LAN I can solve all of the problems listed above, but I will have to configure it separately on each of the LANs and it will be a RAM hungry beast.

I was looking at the different performance methods and based on the description decided to try AC-SPLIT. For a VMware environment, would this be preferable to AC-BNFA when trying to optimise for performance while attempting to keep the memory down?

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3173
  • Karma: +821/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #58 on: March 24, 2014, 11:19:47 am »
Well I'm torn between the two setups in my case.

If I set it up on the WAN, I only need to set it up once and it will work for all interfaces. However I lose the ability to see which client generated the alert or, in my case, which LAN it came from which makes it even harder. Also I lose the ability to have different per LAN settings

If I set it up on the LAN I can solve all of the problems listed above, but I will have to configure it separately on each of the LANs and it will be a RAM hungry beast.

I was looking at the different performance methods and based on the description decided to try AC-SPLIT. For a VMware environment, would this be preferable to AC-BNFA when trying to optimise for performance while attempting to keep the memory down?

Everything I've ever seen posted from the Snort VRT guys seems to point to AC-BNFA being the best choice 99% of the time.  It you are trying to keep decent performance but optimize RAM usage, I would stick with AC-BNFA.

Depending on how many rules you choose, Snort can run in 2GB of RAM.  Most folks find it works better with 4GB, though, with the more typical choice of enabled rules.

Bill

Offline cogumel0

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +3/-0
    • View Profile
Re: Quick Snort Setup Instructions for New Users
« Reply #59 on: March 28, 2014, 11:28:39 am »
I read somewhere that AC-BNFA-NQ should provide better performance than AC-BNFA and it also appears to be the default in Snort now, as mentioned here: http://manual.snort.org/node16.html

Currently I have Snort running on a single interface as AC-BNFA-NQ with:

- Snort VRT free Registered User
- Snort Community Ruleset
- ETOpen

with 90% of all rules enabled, on a box with 2GB of RAM and the RAM usage never goes above 35% (it is also running pfBlocker, OpenVPN client + server, Squid + LightSquid, HAVP)...

Are you saying AC-BNFA would be better even?
« Last Edit: March 28, 2014, 11:31:59 am by cogumel0 »