Thursday, April 07, 2016

PFSense with snort

And so i was tasked to settle the pfsense for a small network.
Decided to install snort.

Go to System > Packages > Available Packages > find Snort
Install it.
Get oinkcode from snort website.
Go back to services > snort
Go to global settings
Tick Install Snort VRT Rules
Paste oinkcode
Check Install Snort Community
Check ETOpen
Set auto update to 1 day.
Save.

Go to updates tab.
Update the rules.

Go back to Snort Interfaces tab.
Add a new interface
Set interface to WAN.
Save

Edit the WAN interface.
Check the snort Snort GPLv2 Community Rules (VRT CERTIFED) to enable the snort rules.

and remember to save!

Reference: https://techknight.eu/2015/03/14/pfsense-snort-idsips-basic-setup-and-configuration/

No comments: