{"id":2777,"date":"2020-04-02T17:16:10","date_gmt":"2020-04-02T15:16:10","guid":{"rendered":"https:\/\/tech.lobobrothers.com\/implementing-pfsense-with-suricata\/"},"modified":"2025-02-02T14:40:16","modified_gmt":"2025-02-02T13:40:16","slug":"implementing-pfsense-with-suricata","status":"publish","type":"post","link":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/","title":{"rendered":"Implementing Pfsense with Suricata"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"2777\" class=\"elementor elementor-2777 elementor-517\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45ca8b8b elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45ca8b8b\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-9c04636\" data-id=\"9c04636\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-23b9c834 elementor-widget elementor-widget-text-editor\" data-id=\"23b9c834\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><\/p>\n<h2>FIRST THINGS FIRST<\/h2>\n<div><\/div>\n<div>\n<p>Not all of us can have high-end firewalls such as a Palo Alto because they are not affordable for all budgets.<\/p>\n<p>Therefore I will explain how to set up an opensource firewall with IDS\/IPS based on Pfsense and Suricata, both wonderful projects.<\/p>\n<p>For example, we can have a virtualized dedicated server with Proxmox in OVH with its powerful vrack to interconnect services on different servers or products offered by OVH being all protected by the firewall with IDS\/IPS that we are going to mount, allowing us to have vlans, multiwan, &#8230;..<\/p>\n<p>Depending on your environment and services we want to use we will need some resources or others, the minimum necessary is 1 CPU 500 Mhz, 1GB RAM and 4GB HD. As we are going to use Suricata I recommend 2 CPUs, 4GB RAM and 16GB HD to have high log storage and of course, 2 network cards minimum, one for WAN and one for LAN, but as I say this will depend on what you want to do, for example we have all kinds with 3 WAN and a LAN, 3 WAN and 4 LAN, &#8230;<\/p>\n<\/div>\n<p>To start we download the <a href=\"https:\/\/www.pfsense.org\/download\/\"><strong>ISO from their website for free.<\/strong><\/a><\/p>\n<p>Now everyone will install it in their environment with the appropriate procedure according to their environment, but for KVM environments do not use the Virtio drivers, select E1000 cards in the creation of the VM because the performance of FreeBSD with Virtio is especially poor, there is a solution provided by Netgate which is to Disable hardware checksum offload in System &gt; Advanced on the Networking and reboot, but from experience depending on the load traffic will be cut in a few hours and you will have no choice but to restart the firewall. Common to any environment will be the following.<\/p>\n<p>1.Accept the Copyright<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-527 size-full\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999254.png\" alt=\"pfsense accept copyright\" width=\"720\" height=\"401\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999254.png 720w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999254-300x167.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999254-700x390.png 700w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><\/p>\n<p>2. Select install<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-528 size-full\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999255.png\" alt=\"pfsense install\" width=\"720\" height=\"401\" \/><\/p>\n<p>3. Select language and keyboard, click continue<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-529 size-full\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999256.png\" alt=\"pfsense select languaje\" width=\"722\" height=\"402\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999256.png 722w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999256-300x167.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999256-700x390.png 700w\" sizes=\"(max-width: 722px) 100vw, 722px\" \/><\/p>\n<p>4. In the next step, as we are going to use the entire disk, we do not complicate things and we set Auto(UFS).<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-530 size-full\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999257.png\" alt=\"pfsese partitioning\" width=\"722\" height=\"400\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999257.png 722w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999257-300x166.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999257-700x388.png 700w\" sizes=\"(max-width: 722px) 100vw, 722px\" \/><\/p>\n<p>5. The installation will start, which is very fast, and we will see the following where we will select No.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-532 size-full\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999259.png\" alt=\"pfsense manual configuration\" width=\"718\" height=\"400\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999259.png 718w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999259-300x167.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999259-700x390.png 700w\" sizes=\"(max-width: 718px) 100vw, 718px\" \/><\/p>\n<p>6. And finally Reboot<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-533 size-full\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999260.png\" alt=\"pfsense reboot\" width=\"720\" height=\"401\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999260.png 720w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999260-300x167.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999260-700x390.png 700w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><\/p>\n<p>And ready, as you can see installing is very simple and fast, once restarted we will have the following screen with the available options per shell.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-536 size-full\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999264.png\" alt=\"pfsense shell\" width=\"720\" height=\"403\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999264.png 720w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999264-300x168.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999264-700x392.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999264-539x303.png 539w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><\/p>\n<p>Now as we are with a virtual machine in virtualbox where the Wan is the Lan of our local network and by default can only be accessed by the Lan of pfsense itself which is a different Lan, we will disable the pfsense firewall by console to access the wan, do not do this in production environments unless by mistake you have lost access and need to recover it. to do this select option 8 and write <strong>pfctl -d<\/strong> as in the following image.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-537 size-full\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999265.png\" alt=\"pfsense pfctl -d\" width=\"721\" height=\"406\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999265.png 721w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999265-300x169.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999265-700x394.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999265-539x303.png 539w\" sizes=\"(max-width: 721px) 100vw, 721px\" \/><\/p>\n<p>We can now access through the browser to the Wan ip with user <strong>admin<\/strong> and password <strong>pfsense<\/strong><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-538 size-large\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999266-1024x479.png\" alt=\"wizard pfsense\" width=\"800\" height=\"374\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999266-1024x479.png 1024w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999266-300x140.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999266-768x359.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999266-700x328.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999266.png 1186w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>And follow the Wizard by clicking Next.<\/p>\n<p>First screen general information<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-539 size-large\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999267-1024x545.png\" alt=\"pfsense general information\" width=\"800\" height=\"426\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999267-1024x545.png 1024w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999267-300x160.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999267-768x409.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999267-700x373.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999267.png 1144w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>Time server information<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-540 size-large\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999268-1024x375.png\" alt=\"pfsense time server information\" width=\"800\" height=\"293\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999268-1024x375.png 1024w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999268-300x110.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999268-768x281.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999268-700x256.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999268.png 1145w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>Configuration of the Wan as desired, we will leave it in DHCP since it is a laboratory.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-541 size-large\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999269-1024x826.png\" alt=\"pfsense configure wan interfaces\" width=\"800\" height=\"645\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999269-1024x826.png 1024w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999269-300x242.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999269-768x620.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999269-700x565.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999269.png 1144w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>Here is the Lan as expected hehe<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-544 size-large\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999270-1024x329.png\" alt=\"pfsense configure lan interface\" width=\"800\" height=\"257\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999270-1024x329.png 1024w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999270-300x97.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999270-768x247.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999270-700x225.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999270.png 1147w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>We have less now the admin password<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-545 size-large\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999271-1024x298.png\" alt=\"pfsense set webgui password\" width=\"800\" height=\"233\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999271-1024x298.png 1024w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999271-300x87.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999271-768x223.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999271-700x203.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999271.png 1146w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>Recargamos la configuraci\u00f3n<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-546 size-large\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999272-1024x237.png\" alt=\"pfsense reload configuration\" width=\"800\" height=\"185\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999272-1024x237.png 1024w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999272-300x69.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999272-768x178.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999272-700x162.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999272.png 1150w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>And we run again in console the <strong>pfctl -d<\/strong> because the firewall will be activated again.<\/p>\n<p>We already have the base done<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-547 size-large\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999273-1024x622.png\" alt=\"pfsense wizard completed\" width=\"800\" height=\"486\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999273-1024x622.png 1024w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999273-300x182.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999273-768x466.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999273-700x425.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999273.png 1141w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>For this lab, the first thing we are going to do is to create a rule to allow access through the wan by going to the firewall\/rules\/wan section.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-550 size-large\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999274-1024x389.png\" alt=\"pfsense rules wan\" width=\"800\" height=\"304\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999274-1024x389.png 1024w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999274-300x114.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999274-768x291.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999274-700x266.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999274.png 1149w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>We will add the rule above or below where we are located by selecting Add Above or Add Below, and the following configuration will appear.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-551\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999276.png\" alt=\"pfsense edit rules\" width=\"1024\" height=\"1028\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999276.png 914w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999276-300x300.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999276-150x150.png 150w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999276-768x771.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999276-700x703.png 700w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>In this case as the description says we are giving https Access from any IP to the Wan of this firewall.<\/p>\n<p>We can also use separators to make the management much easier, it is simply a separation with the description that we want for example Firewall Access<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-554 size-full\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999277.png\" alt=\"pfsense apply changes\" width=\"915\" height=\"451\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999277.png 915w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999277-300x148.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999277-768x379.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999277-700x345.png 700w\" sizes=\"(max-width: 915px) 100vw, 915px\" \/><\/p>\n<p>We save and apply, having again to launch from console pfctl -d since by default in the Wan is denied the private networks and they are placed in first position as shown in the previous image without being able to be moved, therefore we will have to deactivate this option in Interfaces\/WAN at the bottom, leaving both boxes unchecked.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-559 size-large\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999278-1024x761.png\" alt=\"pfsense dhcp6 client configuration\" width=\"800\" height=\"595\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999278-1024x761.png 1024w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999278-300x223.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999278-768x570.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999278-700x520.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999278.png 1170w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>Now if we have it ready to access by the wan without needing to deactivate the firewall every time that we apply some configuration, if it did not work and it blocked the access again, restart the machine with the option 5 of the console.<\/p>\n<p><strong>WARNING!!! We repeat this is a laboratory do not do this in Production, use VPN to access or allow only fixed ips if you have from where you connect remotely.<\/strong><\/p>\n<h3>AND NOW?<\/h3>\n<p>We are going to install <a href=\"https:\/\/suricata.io\/\"><strong>Suricata<\/strong><\/a> where its engine is capable of real-time intrusion detection (IDS), online intrusion prevention (IPS), network security monitoring (NSM) and offline pcap processing.<\/p>\n<p>Go to System\/Package Manager\/Available Packages and enter suricata in the search engine.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-561 size-full\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999279.png\" alt=\"pfsense available packages\" width=\"1149\" height=\"410\" \/><\/p>\n<p>Install and confirm on the next screen, this process may take a little while depending on the hardware as there are quite a few files.<\/p>\n<p>Once installed in the services tab you will see Suricata<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-565 size-large\" src=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999280-1024x284.png\" alt=\"pfsense suricata interfaces\" width=\"800\" height=\"222\" srcset=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999280-1024x284.png 1024w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999280-300x83.png 300w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999280-768x213.png 768w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999280-700x194.png 700w, https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/Selecci\u00f3n_999280.png 1149w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>We will leave the configuration for another post since it gives for a post and much more its configuration, is a real opensource pass, you will check it in the following post (Already done in <a href=\"https:\/\/tech.lobobrothers.com\/en\/configuring-suricata-in-pfsense\/\"><strong>Configuring Suricata in Pfsense<\/strong><\/a>)<\/p>\n<p class=\"has-text-align-right\">TL.<\/p>\n<p><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>FIRST THINGS FIRST Not all of us can have high-end firewalls such as a Palo Alto because they are not affordable for all budgets. Therefore I will explain how to set up an opensource firewall with IDS\/IPS based on Pfsense and Suricata, both wonderful projects. For example, we can have a virtualized dedicated server with [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":2801,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49,50,51],"tags":[],"class_list":["post-2777","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux-world","category-open-source","category-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Implementing Pfsense with Suricata - LBT<\/title>\n<meta name=\"description\" content=\"I will explain how to set up an opensource firewall with IDS\/IPS based on Pfsense and Suricata, both wonderful projects.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Implementing Pfsense with Suricata - LBT\" \/>\n<meta property=\"og:description\" content=\"I will explain how to set up an opensource firewall with IDS\/IPS based on Pfsense and Suricata, both wonderful projects.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog sobre linux y el mundo opensource\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/LoboBrothers\/\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-02T15:16:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-02-02T13:40:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/cyber.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"960\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TL\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TL\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/\"},\"author\":{\"name\":\"TL\",\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/#\/schema\/person\/11c359ab9896aa196007651fa6208beb\"},\"headline\":\"Implementing Pfsense with Suricata\",\"datePublished\":\"2020-04-02T15:16:10+00:00\",\"dateModified\":\"2025-02-02T13:40:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/\"},\"wordCount\":908,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/#organization\"},\"image\":{\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/cyber.jpg.webp\",\"articleSection\":[\"Linux World\",\"Open Source\",\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/\",\"url\":\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/\",\"name\":\"Implementing Pfsense with Suricata - LBT\",\"isPartOf\":{\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/cyber.jpg.webp\",\"datePublished\":\"2020-04-02T15:16:10+00:00\",\"dateModified\":\"2025-02-02T13:40:16+00:00\",\"description\":\"I will explain how to set up an opensource firewall with IDS\/IPS based on Pfsense and Suricata, both wonderful projects.\",\"breadcrumb\":{\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#primaryimage\",\"url\":\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/cyber.jpg.webp\",\"contentUrl\":\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/cyber.jpg.webp\",\"width\":1920,\"height\":960,\"caption\":\"Cyber\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\/\/tech.lobobrothers.com\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Implementing Pfsense with Suricata\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/#website\",\"url\":\"https:\/\/tech.lobobrothers.com\/en\/\",\"name\":\"Tech LBT\",\"description\":\"Como apasionados de la tecnolog\u00eda y amantes del open source creamos este blog con art\u00edculos interesantes obre linux, cloud, open source, criptomonedas y ciberseguridad\",\"publisher\":{\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/tech.lobobrothers.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/#organization\",\"name\":\"Lobo Brothers Technology\",\"url\":\"https:\/\/tech.lobobrothers.com\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2019\/06\/logo_red.png\",\"contentUrl\":\"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2019\/06\/logo_red.png\",\"width\":110,\"height\":50,\"caption\":\"Lobo Brothers Technology\"},\"image\":{\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/LoboBrothers\/\",\"https:\/\/www.linkedin.com\/company\/lobobrothers\/about\/?viewAsMember=true\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/#\/schema\/person\/11c359ab9896aa196007651fa6208beb\",\"name\":\"TL\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/tech.lobobrothers.com\/en\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/a2d3b9e0b67bd28fe8248346c09cbe07?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/a2d3b9e0b67bd28fe8248346c09cbe07?s=96&d=mm&r=g\",\"caption\":\"TL\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Implementing Pfsense with Suricata - LBT","description":"I will explain how to set up an opensource firewall with IDS\/IPS based on Pfsense and Suricata, both wonderful projects.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/","og_locale":"en_US","og_type":"article","og_title":"Implementing Pfsense with Suricata - LBT","og_description":"I will explain how to set up an opensource firewall with IDS\/IPS based on Pfsense and Suricata, both wonderful projects.","og_url":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/","og_site_name":"Blog sobre linux y el mundo opensource","article_publisher":"https:\/\/www.facebook.com\/LoboBrothers\/","article_published_time":"2020-04-02T15:16:10+00:00","article_modified_time":"2025-02-02T13:40:16+00:00","og_image":[{"width":1920,"height":960,"url":"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/cyber.jpg","type":"image\/jpeg"}],"author":"TL","twitter_card":"summary_large_image","twitter_misc":{"Written by":"TL","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#article","isPartOf":{"@id":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/"},"author":{"name":"TL","@id":"https:\/\/tech.lobobrothers.com\/en\/#\/schema\/person\/11c359ab9896aa196007651fa6208beb"},"headline":"Implementing Pfsense with Suricata","datePublished":"2020-04-02T15:16:10+00:00","dateModified":"2025-02-02T13:40:16+00:00","mainEntityOfPage":{"@id":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/"},"wordCount":908,"commentCount":0,"publisher":{"@id":"https:\/\/tech.lobobrothers.com\/en\/#organization"},"image":{"@id":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#primaryimage"},"thumbnailUrl":"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/cyber.jpg.webp","articleSection":["Linux World","Open Source","Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/","url":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/","name":"Implementing Pfsense with Suricata - LBT","isPartOf":{"@id":"https:\/\/tech.lobobrothers.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#primaryimage"},"image":{"@id":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#primaryimage"},"thumbnailUrl":"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/cyber.jpg.webp","datePublished":"2020-04-02T15:16:10+00:00","dateModified":"2025-02-02T13:40:16+00:00","description":"I will explain how to set up an opensource firewall with IDS\/IPS based on Pfsense and Suricata, both wonderful projects.","breadcrumb":{"@id":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#primaryimage","url":"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/cyber.jpg.webp","contentUrl":"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2020\/04\/cyber.jpg.webp","width":1920,"height":960,"caption":"Cyber"},{"@type":"BreadcrumbList","@id":"https:\/\/tech.lobobrothers.com\/en\/implementing-pfsense-with-suricata\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/tech.lobobrothers.com\/en\/"},{"@type":"ListItem","position":2,"name":"Implementing Pfsense with Suricata"}]},{"@type":"WebSite","@id":"https:\/\/tech.lobobrothers.com\/en\/#website","url":"https:\/\/tech.lobobrothers.com\/en\/","name":"Tech LBT","description":"Como apasionados de la tecnolog\u00eda y amantes del open source creamos este blog con art\u00edculos interesantes obre linux, cloud, open source, criptomonedas y ciberseguridad","publisher":{"@id":"https:\/\/tech.lobobrothers.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/tech.lobobrothers.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/tech.lobobrothers.com\/en\/#organization","name":"Lobo Brothers Technology","url":"https:\/\/tech.lobobrothers.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/tech.lobobrothers.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2019\/06\/logo_red.png","contentUrl":"https:\/\/tech.lobobrothers.com\/wp-content\/uploads\/2019\/06\/logo_red.png","width":110,"height":50,"caption":"Lobo Brothers Technology"},"image":{"@id":"https:\/\/tech.lobobrothers.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/LoboBrothers\/","https:\/\/www.linkedin.com\/company\/lobobrothers\/about\/?viewAsMember=true"]},{"@type":"Person","@id":"https:\/\/tech.lobobrothers.com\/en\/#\/schema\/person\/11c359ab9896aa196007651fa6208beb","name":"TL","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/tech.lobobrothers.com\/en\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/a2d3b9e0b67bd28fe8248346c09cbe07?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a2d3b9e0b67bd28fe8248346c09cbe07?s=96&d=mm&r=g","caption":"TL"}}]}},"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/tech.lobobrothers.com\/en\/wp-json\/wp\/v2\/posts\/2777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tech.lobobrothers.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tech.lobobrothers.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tech.lobobrothers.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/tech.lobobrothers.com\/en\/wp-json\/wp\/v2\/comments?post=2777"}],"version-history":[{"count":0,"href":"https:\/\/tech.lobobrothers.com\/en\/wp-json\/wp\/v2\/posts\/2777\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tech.lobobrothers.com\/en\/wp-json\/wp\/v2\/media\/2801"}],"wp:attachment":[{"href":"https:\/\/tech.lobobrothers.com\/en\/wp-json\/wp\/v2\/media?parent=2777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tech.lobobrothers.com\/en\/wp-json\/wp\/v2\/categories?post=2777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tech.lobobrothers.com\/en\/wp-json\/wp\/v2\/tags?post=2777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}