Suricata IDS & IPS VS Kali-Linux Attack

-How to setup the Intrusion Detection System (IDS) & Intrusion Prevention System (IPS) in OPNsense firewall.
-Install Suricata Packages.
-Attack Scenario using Kali linux.
-Harden Your Home Network Against Network Intrusions.

[@BrianThomas]

I'm not finding anything on how to setup policy based IDS/IPS with Suricata on OPNSense. They have an online guide, but that doesn't show you the configuration. Sounds like an opportunity for a new video :-)

[@scottelsdon5547]

Nice, and thank you for taking the time to create this.

[@ITNetworksSecurity]

It is my pleasure.
Thank you too.

[@PiotrK2022]

@
IT Networks & Security Damn, nice - I LOVE AND WANT IT.Can it also detect&block wannacry fox example, or other ransomware/ infection?

[@Totototo-nr8dh]

Nice! which opnsense theme are you using? :)

[@Totototo-nr8dh]

cicada ahah

[@ITNetworksSecurity]

@@Totototo-nr8dh yeeees

[@Totototo-nr8dh]

@@ITNetworksSecurity i really like it.

[@ahmedelmenshawy474]

really , it's amazing ...

[@geonelson1621]

Nice video, but I've followed the steps, but it still doesn't working

[@allamaprabhu5861]

Not working

[@muhammadafifalfauzan281]

No working

[@colinmsmall]

Nice video. I would like to see if the other top open source firewalls preform as well. Ipfire with Suricata and pfsense with Suricata. I imagine pfsense will be identical?

[@ITNetworksSecurity]

Yes pfsense its identical.

[@Afraa-K]

What about ipfire? My project is about testing different firewalls. Would the results be identical if i used suricata?

[@Anuitu2u]

@@Afraa-K why not?
The issue would be around hardware performance though. Network adapter driver issue on bsd vs Linux.

[@Afraa-K]

@@Anuitu2u I am testing them using vmware. Is it ok to do that? Or i must test them on their hardware?

[@Anuitu2u]

@@Afraa-K do iperf test. Maybe you'll see the network performance difference. Usually, OPNsense/PfSense would show less.
But, in close environment, like VMware, virtualbox, usually we don't see the full performance anyway. That's what I thought. Cmiiw.

[@freegate971]

video not working

[@misza_one]

I tried replicate your settings. I realized that in the download tab the FILTER column is missing.Version 21.1. I can only choose enable or disable. I hope that it is running correctly though. Thanks for sharing👍

[@rezarizky2294]

same problem

[@marcelo.caetano]

CPU at 100% and Suricata stop.

[@tarikhizem4903]

Good tutorial. Thanks

[@ITNetworksSecurity]

Thank u man

[@Afraa-K]

Thank you so much🙏🏻. May i know the ip addresses of the wan and lan interfacrs of opensense. Because I want to know how the machines are connected.

[@enunna]

4 character password huh. The irony...

[@BrianThomas]

Hey I love Suricata and I tried what you suggested. This is what I received: We strongly advise to use policies instead of single rule based changes to limit the size of the configuration. A list of all manual changes can be revised in the policy editor (available here ) Now what? Does anyone have any advice?

[@Kilzu1]

You can ignore the policies if you want and don't need to block or protect against specific type of thing while being able to use programs and access sites of that same category (for example blocking P2P clients but still being able to run games which are updated using P2P, World of Warcraft for example is one of those).
Policies allow you to create blocks and protection against specific thing, rules block everything belonging to that category.