Re: Doubt with Snort and PfSense
David via Snort-users <[email protected]> Thu, 18 Jul 2024 17:33:22 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
Hello, I already had checked those resources but in none of them I saw how to change in all the rules from alert to drop action, something needed as far as I understand to really block even if it is working in blocking mode; I mean, if I enable blocking mode but the rules are in alert action, no block will happen at the end. Also, note that I am not starting with blocking, I have been working with alerts for months to ensure the behaviour. Thanks! -------- Mensaje original -------- El 16/7/24 17:52, Ulises Mora Alvarez ha escrito: > Hello. > This is not the case, I suggest you read the Netgate guide. > https://docs.netgate.com/pfsense/packages/snort/setup.html > > [docs.netgate.com](https://docs.netgate.com/pfsense/packages/snort/setup.html) https://docs.netgate.com/pfsense/packages/snort/setup.html > > I also suggest a look at this video.... > https://youtu.be/2q_g9GgkvWA > > [youtu.be](https://youtu.be/2q_g9GgkvWA) https://youtu.be/2q_g9GgkvWA > > In my experience, when using an IDS/IPS, like Snort, the tricky thing is not to start blocking, but to set which alerts should be suppressed and which exceptions to put to avoid problem to the users. > Ulises M. Alvarez > >> El 16 jul 2024, a la(s) 8:43 a.m., David via Snort-users <[email protected]> escribió: > >> >> Hi all, >> >> I have enabled and configured Snort in PfSense and now I would like to block the offenders, but I see I need to go rule by rule, for each category, changing from 'Alert' to 'Drop'. Does anyone know a way to change this in all at once? >> >> Thanks. >> >> _______________________________________________ >> Snort-users mailing list >> [email protected] >> Go to this URL to change user options or unsubscribe: >> https://lists.snort.org/mailman/listinfo/snort-users >> >> To unsubscribe, send an email to: >> [email protected] >> >> Please visit http://blog.snort.org to stay current on all the latest Snort news! >> >> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette