Lab 07 IDS/IPS with Suricata and pfSense

Introduction

Many users seem to think you can just install the Snort package and forget about it and your network will be protected. That's not true. You have to install the package, enable some rules, then start disabling false positives or adding suppress list entries for them. You have to analyze what types of assets you are protecting (web servers, mail servers, database servers, etc.) and set up either package keeping the defended networks/servers in mind. You set things like ports, operating system types, etc. Then you make sure the proper rules are active.

This lab introduces you to Suricata.

Lab Goal

Install Suricata on the pfSense box. You may use the documentation from NetGate (be aware that it does not have a specific Suricata install page, but instead points you to the Snort docs). I followed the steps below:

1. Under System -> Package Manager -> Available Packages -> Surricata (install)

2. Under Services -> Suricata -> Global Settings: Setup the rules

   1. You will need to setup an account on snort.org to get an oinkmaster code (hint: its in your profile), follow the link and directions on this pfSense page

   2. You will need to setup an account for the GeoLite2 database follow the directions on this pfSense page.

   3. Rules Setup 1

   4. Rules Setup 2

   5. The rest of the Global Settings setup should be intuitive to you!

3. Under Services -> Suricata -> Updates: Update your rules (they haven't been downloaded yet)

4. Under Services -> Suricata -> Pass Lists: Leave default and save.

   1. Near the end, I didn't use "Assigned Aliases" because there are no "Aliases" in my system at this point.

5. Under Services -> Suricata -> Supress: Eventually you will want to add some rules here, so that your system doesn't get overwhelmed with log entries. Connsider adding:

   1. Invalid Checksum rules for IPv4 and IPv6.

6. Under Services -> Suricata -> Interfaces: Add the WAN interface. Choose default (I didn't change anything yet) and save it.

   1. Under WAN Categories, Select some appropriate rule sets to enable.
   2. Under Wan Rules, Review what is enabled and disabled (I enabled all to start with)

7. At this point we are ready to start Suricata on the WAN interface. Under Services -> Suricata -> Interfaces: Push the green play button

You can now go to the logs view and see what is being logged. Play around a bit with it. Read what the rules actually do (explore). When you are ready create the video as described below.

Show Me

I am starting to add time limits to these labs. It should take you less than 2 minutes to show me the required material. Videos longer than 2 minutes will have points deducted 1 for every 5 seconds. Include voice over in your video to talk me through the elements.

1. Show me your configuration:
   1. Walk me through your Suricata interfaces
      1. WAN Settings
      2. WAN Categories
      3. WAN Rules - make sure they reflect what is needed to protect your system.
   2. Walk me through the Global Settings (identify what you changed)
   3. Show me that your rule sets were updated after the Lab assignment was given.

2. You man not have any alerts on your snort box yet because it is deeply buried behind layers of security already. For 50% of the lab points:

   1. Pick a rule that you have enabled (or that was enabled for you)
   2. Show that there is no alert for it.
   3. Try to violate the rule.
   4. Show that an alert has been logged and that the offending IP has been blocked.

I found this site to be useful as well