Set Up Snort in PFSense From Scratch (IDS and IPS)

[@melbuilt]

I've just subscribed. I been looking for someone like you, for a long time. Nice and slow gets the job done, correctly. Looking forward to more content from you.

[@RedBlueLabs]

Thanks so much for the comment. :) What are some other areas of cyber that you enjoy watching on KZbin? Some niche tech stuff that my channel could potentially do?

[@TheReal_FishFins]

Love how much you experiment and show off neat stuff!

[@RedBlueLabs]

Thanks for watching, the way I learn is to try out the different things and see how it works. I hope these videos are helpful and enjoyable :)

[@LearningandTechnology]

Great video! Well-explained and very useful.

[@RedBlueLabs]

Thanks, I really appreciate that:)

[@whats_skills]

Great video! I wish snort could send an email or slack notification when it alerts. But I guess I can log the alert and trigger an email notification using a script or another package like kibana. :p

[@RedBlueLabs]

@@whats_skills check out suricata or zeek. I would have to double check about suricata. These tools have similar functionality to snort. Snort is a really good place to get learning about IDS and IPS. Thx for watching the video :)

[@classicalbert]

Great Video! Thanks!!!!

[@RedBlueLabs]

I'm glad it helped!

[@senzyy46]

hello sir I want to ask, do you do the test in the same network, namely the LAN that you installed the snort? or how?

[@RedBlueLabs]

@@senzyy46 typically it would be for the LAN, however depending on how you have built the network, snort would be useful also on opt1. I would not run it on WAN though. Thx for watching and leaving a comment

[@senzyy46]

@@RedBlueLabs I have tried but have a problem where when I do testing why the source is always 192.168.1.1, what's wrong? The destination is correct.

[@gtag174]

How does the CPU and resource look like after deploying SNORT ?

[@RedBlueLabs]

great question, because snort (and especially if you are using IPS) has to analyze every packet you will notice an increase usage of resources on your pfsense machine. Depending on how you have built the PFSense this potentially is not an issue. I know a lot of folks in industry who set up pfsense in a virtual environment and can allocate lots of RAM to their pfsense instance. Thanks for watching and leaving a comment

[@k.elysee6527]

I'm running pfsense on kali and when I go to Package Manager & look for Available Packages I get a "Unable to Retrieve Package Information" Any advice or suggestions?

[@RedBlueLabs]

@@k.elysee6527 double check your Internet access. After this double check the rolling release in your kali. Depending on how you installed kali sometimes it mixes up how rolling releases work. Anytime I have had that error message is because of the releases. You can do it! Thx for watching:)

[@k.elysee6527]

@RedBlueLabs Thanks for the information & advice! Very much appreciated!

[@philippef.4590]

Thankyou

[@RedBlueLabs]

@@philippef.4590 thx for watching:)

[@jordanaldrich]

Great video. Thanks!

[@RedBlueLabs]

@@jordanaldrich thanks for watching:)