Number of activated rules

[trish]

Is there a way to keep the number of activated rules in the IPS log to a minimum using a Firewall rule or anything else?

My Suricata gets triggered by incoming traffic on RED. with every port scan and ping 10,000 times a day for no apparent reason.

I have no incoming rules coming from RED to GREEN, so I don’t mind closing the firewall. to any incoming traffic. I also have IP address blocklist setup but SURICATA get triggered anyways.

My IPfire version is 202

[ag (Adam Gibbons)]

Hi trish.

You could just turn off the individual rules which are creating the mass logs. Some rules are just for information and will spam your logs.

Some info here:

Rulesets - Intrusion Prevention System (IPS)

Thanks,
A G

[trish]

Hi Adam.

I turned off the informative rules, the 10000 alerts are actual attacks.

I just don’t understand why do they get triggered.

Maybe Location block and Firewall are not preventing these attacks?

[hjkl (H&M)]

@trish

Maybe Location block and Firewall are not preventing these attacks?

Have a look at IPFire FW diagram and you will see that IPS sees the packet prior to BLOCKIN or other rules.

This is why I’ve build that diagram in first place: to provide a visual path

Firewall Diagram

Version 1.5.1 is released - nat and mangle tables fully expanded. Newly visible chains include SQUID (transparent proxy in nat/PREROUTING), IPS/Suricata chains (in mangle INPUT/FORWARD/OUTPUT), and CAPTIVE_PORTAL (nat/PREROUTING). [ipfire_pcb_firewall_core200_v1.5.1_TB]

[trish]

Thank you for your suggestion,
I will try to run the FW Diagram

[trish]

I used your Firewall Diagram and you are completely right. it shows clearly that IPS

SCAN IN shows way before HOSTILE or BLOCKLIST OUT AND LOCATIONBLOCK.

Is there a way to have Location Block or Firewall process it first?

[trish]

[hjkl (H&M)]

@trish

Is there a way to have Location Block or Firewall process it first?

No, as far as I know.

I am glad that diagram helped you to visualize the packet path through all the chains.

Now you know why some attacks still reach your OpenVPN server despite rules were added in Web UI: Web UI adds them in a chain that sits after de OVPNINPUTRW. And Web UI does not expose OVPNBLOCK chain - you have to manually edit firewall.local or use my firewall local add-on (I’ve build it because somebody hammered my OpenVPN server for days in a row - 10-15 attempts per minute).