Suricata can work with PF?

[wolffnx]

Hi, suricata have support to PF ? apart than ipfw?
thanks

 

[NapoleonWils0n]

i used to use suricata on pfsense
but i found that it got trigger updating packages on Freebsd

took me a while to figure out what the issue was and why i couldnt update Freebsd
it may have been how i had suricata set up

just a heads up in case you get it set up and then find freebsd updates get blocked

 

[wolffnx]

i used to use suricata on pfsense
but i found that it got trigger updating packages on Freebsd

took me a while to figure out what the issue was and why i couldnt update Freebsd
it may have been how i had suricata set up

just a heads up in case you get it set up and then find freebsd updates get blocked

for now the basic setup was fine,but I'dont need strictly suricata, I'just want to do a L7 firewall in FreeBSD in conjunction with PF

 

[DtxdF]

for now the basic setup was fine,but I'dont need strictly suricata, I'just want to do a L7 firewall in FreeBSD in conjunction with PF

www/bunkerweb

 

[SirDice]

I'just want to do a L7 firewall

What kind of traffic? What do you want to monitor and/or block?

 

[wolffnx]

What kind of traffic? What do you want to monitor and/or block?

Like a WAF firewall, inspect and handle the ssl,tls conecctions and allow,log or deny trough PF

 

[SirDice]

Your firewall host won't be able to view what's inside the SSL/TLS connection. It's end-to-end encrypted (from client to server).

You will probably be able to do this with a (web)proxy that can do SSL/TLS interception.

 

[wolffnx]

Your firewall host won't be able to view what's inside the SSL/TLS connection. It's end-to-end encrypted (from client to server).

You will probably be able to do this with a (web)proxy that can do SSL/TLS interception.

yes,I'need to open/reasemble the package, haproxy sounds god
I only used it in PFsense as a reverse proxy but it feels more mature proyect

 

[putney]

You may find it worthwhile to read <https://www.archy.net/building-a-native-fail2ban-with-haproxy-stick-tables/>, perhaps especially the section "Runtime API: Ban and Unban Without Reload".

It describes the use of tables within haproxy to hold banned addresses. But there's no effort described to automate lifting bans after a configured period.