Suricata IDS/IPS Installation on Opnsense - Virtual Lab Building Series: Ep3

[@ls111cyberEd]

A quick note, at 2:02 in the video I mention disabling hardware checksum offloading, TCP segmentation offloading and large receive offload and then proceed to uncheck the checkboxes. This is my error and they should remain checked. Thanks to those in the comments that also pointed this error out.

[@TheCarlosm89]

After I copy my xml file to opnsense, it does not show in the download list. Any ideas how to fix this?

[@ViszlaBoss]

How do i get back to my WEBgui now? Didnt see your correction now cannot get to the WEBgui?

[@steveyoung5848]

@@ViszlaBoss I may have experienced the same thing. It went unresponsive and I had to delete the opnsense vm and start from scratch.

[@theprettybond159]

@@steveyoung5848 You can just restore factory defaults and reset the ip of the wan and lan, full deletion isnt needed

[@nickquik]

​@ViszlaBoss it would be responsible for him to speak on this since following his tutorial messed it up

[@melvindrake22]

great lab and very informative videos. I've been following this series and everything is working as intended. Once completed I'll tear it all down and build it again from my notes. Thanks for taking the time to do this and explain in detail.

[@leckovich]

could you find the rules files?

[@urfriendsamir]

Going through this right now! Got the rule to work and pick up the reconnaissance scan! This will serve as a worthy project in my portfolio! Thank you!

[@leckovich]

did you find the rule files?

[@roxasdracun8661]

@@leckovich I kinda confuse myself as he just skips steps assuming we know how to do stuff but most im seeing the rules like file is under /var/lib/suricata/rules/suricata.rules Which a bunch of rules have already been created by preset. As for us creating one and if we need to configure suricate to be able to other stuff I am quite lost. Following this video right now as kinda makes a bit more sense: kzbin.info/www/bejne/i4muk5tmn7WDpsk

[@lorneshantz4892]

I think I have found a conflict. At 2:25 you speak of unchecking these. I think that is backwards. 1. When I tried to uncheck them, things broke. So I did some research and Opnsense specifically says: When using IPS mode make sure all hardware offloading features are disabled in the interface settings (Interfaces ‣ Settings) So if you read carefully what it says, being checked is disabled. Unchecking does the opposite of what you are trying to do. UPdated: Sorry! I see you have posted a correction. I missed that.

[@nickquik]

My gui disappeared after doing that and now I can't access my router 😭

[@p4r4d0xhacks]

Just loving the content. Learned so much in just 2 videos.

[@emeraldsoul6200]

As soon as I apply the IDS settings, the connection on OPNsense like: "netnap_transmit ... drop mbuf that needs checksum offload

[@zoomingby]

Suggestion: 1:00 when making statements like "IDS will detect anomalies" which is somewhat vague and opaque, can you give us an example how it would for a typical user or a use case or a scenario and what might happen if an IDS wasn't installed? Using an example of how it would protect us or situations where we'd be detected makes it much easier to grasp the concept.

[@viteks.100]

Having the strange feeling when I don't know if I like you or I hate you! Looks like new version of Opnsense kinda buggy , and needed to install older version. Now after all it's working correctly, thank you very much.

[@skullcrusher4307]

Hello! I enjoyed watching the video. I have a question: will this work if I have high availability set up? Will I need to do the configurations on both firewalls? Cheers!

[@ls111cyberEd]

Hi, Thanks for watching, The short answer is yes, you will need to make sure that when you configure your HA settings, under the XMLRPC sync, select the "intrusion detection" option and it should sync the settings between the master and backup firewall.

[@catlmarc9618]

Great Videos. Glad I found your channel

[@WarThunderista]

Everything works fine Thanks 👌

[@davidaliata8719]

Thank you for this videos, they are very informative. Can you please share the two custom files ?

[@hanshopman3487]

Well, good course, but got stuck in ep3 when activating IDS and disabling the ofload. OPNSense 23.7 console says "drop mbuf that needs checksum of fload". The webinterface stopped responding. I wished i had read the pinned comment before watching the video, because now i am locked out of OPNSense. Restoring yesterday backup fixed the issue.

[@abodawead9039]

Great job man

[@magueritemichima6818]

hello , great video , so i will like to know did you and install suricata ids on opensense ? in your video you just import rules from kali to openses, you also talk about proofpoint free rules , how can we install this modules on opensense ?

[@Skylinar]

2:16 You disabled the checkboxes within Interfaces > Settings but if you take a look to the infotext it shows that: Checking this option will disable hardware checksum offloading. In my understanding this would mean you have enabled it or am I wrong?

[@szubert]

Yes, he turned it on instead to turn it off ;) Here is a video from closest to source of Suricata: kzbin.info/www/bejne/laqsomZ9gpmaoKM

[@szubert]

Also in "home networks" lot of sources are telling that you need put there a WAN subnet, not only the LAN subnet.

[@xXxCobraCommanderxXx]

I agree, he did it backward.

[@roxasdracun8661]

Kinda confuse , the rule was for suricata was there didnt show how to create as well with the pro telemetry thing not sure if we need to create another VM with it or how to integrate to current OPNSENSE

[@Morfoz13]

Thanks for this great tutorial! Should I also modify any of the rules in the Rule tab? Mos of them are set to alert, should I change them to drop?

[@ls111cyberEd]

Thanks for watching! The choice is entirely yours based on your unique requirements on how you wish to set this up. If you choose to drop the packet it will stop processing the packet and alert. If you choose just to alert, the packet will still be allowed and only an alert will be sent, for further analysis.

[@trevorfadale7237]

Has anyone figured out the import of the rule into opnsense??

[@osmaster3327]

Could you share the rules file please?

[@isee-9625]

I have an issue with Suricata not show alerts in the "Alerts" view of the web interface I have reviewed all the materials that I could find a and still can't get this to work properly

[@delodare5770]

i have same problem

[@FTLN]

Why are you enabling Hardware checksum / Hardware TCP / Large receive offloading ?? Documentation clearly states thes should remain disable.....

[@alexeyiah89]

i followed this for the past 3 days i can't get the firewall to generate any alert after the port scan, is there anything i'm missing?

[@cleon5950]

9 months late but the > in the rules should be ->

[@scottjmagee]

Awesome, thanks!

[@dkcarey1]

What’s the difference between using this and Zenarmor? Which is better, or can you use them both side by side?

[@ls111cyberEd]

Hi there, Zenarmor basically uses Suricata in the background to achieve the same result. Zenarmor is generally easier to setup and use. As a side note, if you try to run Zenarmor and this at the same time you will get a error. You will need to disable this firstly, then install Zenarmor. If you have not already seen I have a video covering this: kzbin.info/www/bejne/iISxhmCXit-ZnaM

[@dkcarey1]

@@ls111cyberEd thank you

[@MarekCezaryWojtaszek]

In 8:06 you mention that you will leave information in the description about a plugin needed for the pro rules but I could not find it. Could you please advise?

[@ls111cyberEd]

Thanks for watching. The link is included in the description under ET Pro Telemetry, but for your convenience, I have included it here shop.opnsense.com/product/etpro-telemetry/ All the links to get the PRO plugin working and more info about ProofPoint can be found there.

[@MarekCezaryWojtaszek]

@@ls111cyberEd Thank you! Actually I figured it out just after posting my question :). Anyway, great video as all other materials from your channel. Adding to my favorites :)

[@ls111cyberEd]

Thanks, @MarekCezaryWojtaszek, I appreciate the support!

[@funmemes5915]

Great Stuff

[@mytime2016]

Hi bro my rules are enable but when u click on download and update rules still does not install

[@TahmaseebZaman]

does Enabling the IDS/IPS feature reduce the link speed in this case? if so how much does it reduce? I know Ubiquiti UDM Pro link speed goes down to 3.5gbps from 10gbps, at least that's what it says on the specification. so I'm guessing something similar will happen here too.

[@ls111cyberEd]

Yes your are correct, anywhere that you apply additional processing/filtering of traffic on your network you will note throughput degradations regardless of the manufacturer, software or appliance used. As to how much in this case I cant give you an exact amount because it will be dependent on things like hardware variables and number of users on the network. for e.g. If I install OPNSense on high-end hardware with a powerful CPU and Intel based NICs naturally we can expect better throughput than if we use lower-end hardware. According to the OPNSense manual their recommended hardware spec is 1.5Ghz multi-core CPU, 8GB RAM, 120GB SSD and they state a throughput range of 350-750+ Mbps with the full feature set enabled, which includes Squid Proxy, Captive Portal etc. I hope that this answer helps. 👍

[@pawemaleszewski133]

In my case on Zimaboard 432 and intel i350-t4 card without IDS 700mbits down 100 up. With IDS on 500 mbits down/100 mbits up. Home environment so its not even noticeable

[@Abobo007]

I’m stuck at getting alerts on my IDS. I’ve tried every thing I know to troubleshoot but no alert still😭😭

[@armstrongnhlabatsi1925]

I am facing the same issue. No alerts in my IDS

[@Abobo007]

@@armstrongnhlabatsi1925 I’m still stuck there tbh lol. Im hopeful to get a solution

[@eliepakabilond4075]

Hi bro. Check your custom map rule. You might have picket http traffic instead of tcp.

[@viettran3959]

Daddy, in the rulesets section, the customnmap file appears. I noticed in the video that it shows both customnmap/customnmap rule, while mine only shows the customnmap rule. I cannot download them, only enable them.

[@juansanjosepena4074]

great video!!

[@nnekalyn4494]

I can't get filezilla to connect at all on port 22. Tried port 21 and the connection attempt drops due to "20 seconds of inactivity". Not sure the issue here,since i did the Nmap scan and port 22 is open. My login credentials allow me to log into OPNsense, but create an authentication error for Filezilla. Help?

[@ls111cyberEd]

Hi and thanks for watching, please double check that SSH has been enabled like I showed from 13:16 onward and that you have your listening interface set to LAN, this will automatically take care of the firewall rules for you opening that port. The reason port 21 wont work is because firstly we don't have any services listening on port 21 (FTP) and secondly the firewall will drop it since we have not told the firewall to explicitly allow it. Secure FTP (SFTP) listens on port 22. When you are in filezilla please make sure that you use sftp://x.x.x.x and the port number 22 with your OPNSense username and password, it should then connect.

[@stellar369]

Please someone reply to this, I have enabled NAT and Intnet (2 adapters) on both Opnsense and Kali linux. Then I used WAN address from opnsense as default gateway on kali linux. Now, on my kali linux, I can work on opnsense gui but nothng else on the internet is working. Is it online or offline, does it needs Internet as well?

[@SuperKkamran]

Hi, wonder if this is still active. I cannot access web gui after enabling IPS/IDS as described from lecture from 5:25. I clicked Apply and it kept spinning and after that no access. It's pinging though!

[@logs4040]

Not what he said to do but I kept having a bunch of issues including this until I just enabled DHCP for the interface... might break things later though.

[@ls111cyberEd]

Hi and thanks for watching, nothing at this stage of the process should prevent you from accessing the firewall that comes to mind, just double-check that you have set up your home network and interfaces correctly and worst case reboot the FW and try again.

[@ls111cyberEd]

Thanks for watching, using static IP addresses or DHCP is totally your choice in this lab and if either of these options are set up correctly everything will work. I chose static IP addresses to keep everything consistent when creating this lab, DHCP being dynamic in its operation can not guarantee that same consistency.

[@logs4040]

Thank you

[@SuperKkamran]

It's updated version. The error reads' "411 netmap_transmit em0 drop mbuf that needs checksum of ...." Applied on both LAN and WAN interfaces, one by one. Before enabling IPS, it works well.

[@SageN-]

The rule is not reflecting on the firewall what could be the issue? even after setting up the server

[@eliepakabilond4075]

Check you custom map rule. You might have written http instead of tcp

[@y.s.mcgeechen656]

Does anyone know how to restore those 3 Hardware settings after unchecking them? I cannot login to the Web GUI

[@davidedamico5321]

you have to reset the machine trought the vm of opnsense, login and after insert 4 for favtory reset, or user one of the automatic backup using the option 13

[@user-zr7kz4vs7c]

Do I still need IPS if I don’t open ports on WAN side?

[@ls111cyberEd]

Thanks for watching! Yes, it's a good practice to monitor your outgoing or egress traffic. Just a basic example, let's say a user on your network unknowingly downloads malware or something malicious, by using an IPS/IDS on the outgoing traffic you could detect and prevent the malware from calling home for instance.

[@valbuz]

When i want to activate the IDS, this ends with a error: [100207] -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol http2 enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details. Is there any workaround? Thanks Pat

[@ls111cyberEd]

Hello Pat, I went to have a look at the ticket as advised by the message, you can have a look here: redmine.openinfosecfoundation.org/issues/4744 It seems this is just a warning at this stage and should not prevent you from completing the lab. The way I understand the ticket, it has to do with the app-layer protocol section in the suricata.yaml config file where if this section is missing in the config file, the system will automatically enable it as a workaround in versions 6.0.x of Suricata. For future versions of Suricata 7.0 (which is in the Release Candidate stage of development) they just state that this protocol section will need to be explicitly defined in the .yaml file or it wont work moving forward. Since Suricate is baked into the OPNSense firewall it will most likely be patched or upgraded before Suricata 7 moves into stable release. Hope that this answer helps!

[@medidarmawan5247]

Is there an ebook or blog version?

[@ls111cyberEd]

Hi, unfortunately not, my main focus right now is to produce video content, however, I may write about this at a later stage, you can keep a eye on my blog if you like. Link ls111.me

[@MrArsalan1988]

nice

[@arseniobrown7744]

When I click Download and update rule nothing happens what should I do to fix this.

[@ls111cyberEd]

Hi, thanks for watching! Please double check that your python http server is running from the directory where you placed your rules as seen in the video at 18:40, hope that helps.

[@MrIrelevant12]

@@ls111cyberEd I ran into this issue and it took me a while to find out why. Make sure your customnmap.xml file is correct whether that be the correct IP or the correct format. I had formatting issues in mine.

[@viettran3959]

@@MrIrelevant12 broo, What is the correct format? Should I use the .xml file extension?

[@MrIrelevant12]

I just copied both files from the video, but you have to be very careful with the formatting. I just checked each line.@@viettran3959

[@steveyoung5848]

@@MrIrelevant12 Good call! I couldn't get my customnmap.xml file to serve to opnsense due to a missing / in the file! All it takes is one missing character sometimes to throw things off.

[@mohammadwleed3701]

I want to contact you, is it possible?

[@baskaranranujan7234]

unable install filezilla on kali linus vm "Package filezilla is not available, but is referred to by another package. This may mean that the package is missing, has been obsoleted, or is only available from another source "

[@nnekalyn4494]

had to update my kali in order to get it

[@baskaranranujan7234]

@@nnekalyn4494 I did unable to do let me try again

[@leckovich]

its a shame to start a lab like this and cannot advance because rules are not available anywhere, so its imposible to continue. I wont recommend this lab, just imposible to continue

[@Beyondlimits-m6f]

boring sorry