Setup Suricata IDS/IPS on OPNsense

[@karloa7194]

What every one forgets is this is only applicable if the traffic is not encrypted. The majority if traffic now is encrypted. The block list is probably better. The traffic needs to be decrypted for this to be useful.

[@nocmadman]

Waiting on your wireguard VPN guide as so far your guides have been the easiest to follow i have seen.

[@ecotts]

I believe its going to be integrated in to Opnsense in upcoming releases like OpenVPN is.

[@rjarow]

great channel, and great explanation skills on all these videos! thank you very much!

[@DeepTrueCrime]

Great video Kevin! Keep it up man!

[@x0rZ15t]

Love your videos! Keep up the good work!

[@GetMeTheGeek]

Thanks. I'm glad you liked it.

[@saulsadler3305]

Thank you for all these great tutorials. I want To request an additional tutorial video. On how to make a second and third IP Subnet able to access the Internet. I am continually getting stuck on this. I can only get one subnet through to the internet. The others I cannot get through. I can’t figure out the right NAT policy to connect them to the Internet.

[@shuaibchoat3425]

Thank you! Excellent video and advice 👍🏻

[@lorneshantz4892]

Quite a few holes. You assume we have seen some other video. You assume we know how and have already installed IPS of some sort. Wouldn't it better to make no assumptions and just start from the beginning?

[@roylaprattep]

Seriously, I don't wanna be rude, but you are missing a couple steps in your tutorial... Without a policy, nothing's gonna be filtered.

[@discgolfamateur2175]

Yes good video but leaving out a few important bits. Also should be enabled on LAN if you are NATed, if not pretty much pointless

[@MarcoSerralheiro]

It's the second video I see done by someone that has no clue. People should at least learn and test before teaching.

[@kritikapathak2728]

Thank you so much sir! I have a question, I have created a two virtual machine hosts Virtual machine a and virtual machine b, and I have one opnsense firewall. Now I want to know how these two virtual machines will communicate to different domain names through firewall rule proxy server? Thank you!

[@NiraldoLima]

hello, could you show us how to generate access report in OPNSENSE?

[@nullnull9877]

Thank sir, is usefull. We can also get free list with telemetry proofpoint plugins. I have a question, i can see the label description "let out anything from firewall host itself" in firewall live log, when i activate log on the lan interface (allow 53,80,443) in firewall live log, its a normal message? (we can ignore them?)

[@GetMeTheGeek]

Good question. I only have it turned on for the Wan side. I have Zen armor on the Lab side. You cannot run them both on the same interface at the same.

[@matldn2697]

I am thinking of installing opnsense. Is suricata built into opnsense or I have to install it manually?

[@GetMeTheGeek]

It is built in. All you will need to do is update OPNsense then followy video. Reach out if you have any questions

[@matldn2697]

@@GetMeTheGeek Thank you so very much.

[@Morfoz13]

How do you know if the fw does drop the malicious packages or it just gives alert, or maybe nothing....?

[@Kilzu1]

It reports if packet was dropped, passed or just alerted. If it won't drop or alert any malicious packets, then it means it didn't even detect it. Fair note, you SHOULD monitor reports for a while. Especially the free versions literally can block for example youtube if you set everything in video streaming category to be dropped, same with online games, software updates etc. It is just plain firewall filter and it will block pretty much anything you want, or don't want if you don't configure it properly.

[@JasonsLabVideos]

AWESOME SAUCE MAN !!! this is good !!

[@GetMeTheGeek]

Glad you liked it! This concluded my OPNsense series for now. Time for a new series.

[@JasonsLabVideos]

@@GetMeTheGeek Different firewall ? or ?

[@vladimirtravalja7692]

no offence but this video does not show or explain anything that official opnsense docs are showing.... For example, you should explain what are the most common good rules that are worth enabling and should focus on... There are literally gazillion of them and not all should be enabled (performance wise). Good example would be rules for social networks. Someone can enable this rule without thinking just by watching your video and cause an issue to his/her colleague that might be using social networks for work - "advertising", then again DoS should be mentioned or perhaps port scanners, or how to create a custom rule to block "shodan"). One more important thing which you failed to mention and that is, all those rules will only "alert" as far as I am aware, so basically it will work as IDS and not IPS (please correct me if I am wrong).... You can change those definitions to drop to be more efficient in blocking problematic traffic depending on your requirements -> this should be covered instead...

[@SuperKkamran]

Hi after following all the steps, getting netmap_transmit em0 drop mbuff that need chechsum of flood. Can't access web gui though internet is working. Any help, please.

[@LuisEnrique-mi9ek]

Why you not explain the most important detail when you activate SURICATA IPS to LAN block access to GUI i cannot access GUI when suricata is activated. I cannot find any single clue to validate the configuration to work, even doing rule for the specific port

[@ai_university]

Crontab rules actually meant at 12:00pm, not every 12 hours. That means every 24 hours. Otherwise, nice video, thank you.

[@zyghom]

there is no "next time" in this playlist ;-(

[@GetMeTheGeek]

What would you like to see next?

[@blender_wiki]

In nowadays with almost any connections encrypted Is pointless randomly install suricata. Or you know exactly what you are looking for or is just a waste of resources. If you think you need it hire a professional or you will not find anything.