Suricata can work with PF?

[wolffnx]

Hi, suricata have support to PF ? apart than ipfw?
thanks

 

[NapoleonWils0n]

i used to use suricata on pfsense
but i found that it got trigger updating packages on Freebsd

took me a while to figure out what the issue was and why i couldnt update Freebsd
it may have been how i had suricata set up

just a heads up in case you get it set up and then find freebsd updates get blocked

 

[wolffnx]

i used to use suricata on pfsense
but i found that it got trigger updating packages on Freebsd

took me a while to figure out what the issue was and why i couldnt update Freebsd
it may have been how i had suricata set up

just a heads up in case you get it set up and then find freebsd updates get blocked

for now the basic setup was fine,but I'dont need strictly suricata, I'just want to do a L7 firewall in FreeBSD in conjunction with PF

 

[DtxdF]

for now the basic setup was fine,but I'dont need strictly suricata, I'just want to do a L7 firewall in FreeBSD in conjunction with PF

www/bunkerweb

 

[SirDice]

I'just want to do a L7 firewall

What kind of traffic? What do you want to monitor and/or block?

 

[wolffnx]

What kind of traffic? What do you want to monitor and/or block?

Like a WAF firewall, inspect and handle the ssl,tls conecctions and allow,log or deny trough PF

 

[SirDice]

Your firewall host won't be able to view what's inside the SSL/TLS connection. It's end-to-end encrypted (from client to server).

You will probably be able to do this with a (web)proxy that can do SSL/TLS interception.

 

[wolffnx]

Your firewall host won't be able to view what's inside the SSL/TLS connection. It's end-to-end encrypted (from client to server).

You will probably be able to do this with a (web)proxy that can do SSL/TLS interception.

yes,I'need to open/reasemble the package, haproxy sounds god
I only used it in PFsense as a reverse proxy but it feels more mature proyect

 

[putney]

You may find it worthwhile to read <https://www.archy.net/building-a-native-fail2ban-with-haproxy-stick-tables/>, perhaps especially the section "Runtime API: Ban and Unban Without Reload".

It describes the use of tables within haproxy to hold banned addresses. But there's no effort described to automate lifting bans after a configured period.

 

[SirDice]

I'need to open/reasemble the package, haproxy sounds god

If it's for incoming traffic through haproxy (i.e. monitor/protect a website), you could do the SSL/TLS termination on the proxy and send the traffic unencrypted to the backends. You can also do some basic filtering on haproxy itself.

If it's for outgoing (i.e. users browsing the internet on your network) you'll need something like squid with SSL interception to be able to monitor and/or block anything of its content.

(Turns out this is more a network service issue than a firewall one, moving it to Web and Network services)

 

[SirDice]

www/bunkerweb

That looks quite interesting. I'm definitely going to play with it and try it out.