Configuring Snort 3 in Netgate Nexus¶

The Snort 3 package is available exclusively in Netgate Nexus and enables pfSense Plus software to act in a role similar to intrusion detection or prevention systems (IDS, IPS).

See also

Snort 3

Prerequisites¶

Before configuring Snort 3 there are a few necessary prerequisite steps.

Access the Nexus GUI¶

Snort 3 is only available in the Netgate Nexus GUI and all configuration for Snort 3 must be performed there.

For information on accessing the Netgate Nexus GUI, see Access the Netgate Nexus GUI.

Install the Snort 3 package¶

The Snort 3 package must be installed before it is available in the Netgate Nexus GUI. See Installing Snort 3 for details.

Register for a Snort 3 account and obtain an Oinkcode¶

Some Snort 3 rulesets require authentication to download. There are free rulesets available, but they still may require registering before Snort 3 can download the rules.

Open the snort.org website
Register an Account if not already registered
Sign into the account
Click Oinkcode on the left side menu
Copy the Oinkcode from the page and keep it in a safe place

If an Oinkcode does not appear, Click Regenerate.

Warning

Treat the Oinkcode the same as an API token or password.

See also

Oinkcodes on the Snort website
Snort FAQ

Configure Rulesets¶

For Snort 3 to do anything useful, it must have detection rules available.

This recipe only uses the Snort Registered Rules to keep the example simple. There are several additional types of rulesets that Snort 3 can use. For example, Snort Community Rules, Emerging Threats rules, Talos LightSPD, and more.

Locate Ruleset¶

Start by determining which rules to download:

Open the Netgate Nexus GUI
Navigate to Services > Snort 3, Global Settings tab
Note the Version printed in the Snort 3 Service section, e.g. 3.12.2.0,1
Open the snort.org website
Sign into a snort.org account
Navigate to https://www.snort.org/downloads/#rule-downloads
Locate the Snort v3.0 section in the Registered column

If the column is dim/disabled, double check that the account is logged in.
Find the rules snapshot which matches the installed Snort Version, e.g. snortrules-snapshot-31200.tar.gz
Add that filename to the end of the standard Snort rules location, https://www.snort.org/rules/

For example: https://www.snort.org/rules/snortrules-snapshot-31200.tar.gz
Add the Oinkcode to the end URL as ?oinkcode=<code>

For example: https://www.snort.org/rules/snortrules-snapshot-31200.tar.gz?oinkcode=a1b2c3d4e5
Save the full URL for use in the next section

Add Rules Download Service Entry¶

The next task is to define a Rules Download Service entry:

Open the Netgate Nexus GUI
Navigate to Services > Snort 3, Global Settings tab
Click the Add Rules Download Service button
Configure the entry as follows:

Enable
On

Name
A brief name for the ruleset, e.g. SnortReg

URL
The full URL to the ruleset with the Oinkcode at the end.

For example: https://www.snort.org/rules/snortrules-snapshot-31200.tar.gz?oinkcode=a1b2c3d4e5

Description
Registered Snort Rules
Click OK
Click on the newly added row to trigger a ruleset update
Wait for Netgate Nexus to download and process the rules

When the update finishes, the status will say “Download completed successfully” and show a green Enabled state.

See also

Add/Edit Rules Download Service

Rules Download Schedule¶

To ensure Netgate Nexus updates the Snort rules regularly, set up a Rules Download Schedule.

This example configures updates to occur weekly on Sunday at 5AM.

Navigate to Services > Snort 3, Global Settings tab
Find the Rules Download Schedule section
Configure it as follows:

Enable Schedule
On

Interval
Weekly

Day
Sunday

Time
05:00
Click in the toolbox to save the schedule.

See also

Schedules can be configured for a variety of intervals to suit most needs. See Rules Download Schedule for more detail.

Create a Suppression List¶

This step is optional, but a good practice. When refining the ruleset, a suppression list is useful to suppress rules without disabling them entirely, or to keep a rule active but suppress alerts for traffic to/from specific hosts.

Navigate to Services > Snort 3, Lists tab
Click in the toolbox to create a new list
Configure the list as follows:

Name
External

Description
Suppression list for External traffic

Lua suppression script
-- Test

This is a comment that allows the form to be saved, it will get actual content later.
Click OK

See also

Suppression Lists

Add Instance¶

With the ruleset(s) processed and ready, the next task is to configure a Snort 3 instance to monitor one or more interfaces.

Navigate to Services > Snort 3, Interface Configuration tab
Click in the toolbox to create a new instance
Configure the instance as follows:

Enable
On

Interfaces
Select the interfaces Snort will monitor, e.g. WAN.

Description
Enter a brief description of this instance, e.g. External

Inline IPS
Off

Do not enable this now as there is a risk it may not work properly on some hardware.

Block on Alert
Off

Do not enable this now as there is a high likelihood of false positive alerts until after making adjustments later.

Performance
AC-BNFA

This is not the fastest, but it is the safest and most compatible option to try initially.

Disable checksum checking
On

Home Net
Default

This is a safe option to use initially, it can be refined later if necessary.

External Net
Default

This is a safe option to use initially, it can be refined later if necessary.

Suppression List
External

Skip this option if a suppression list was not created earlier.

Interface Rulesets
Click to expand the ruleset selection interface.

Ruleset Selection
Check the ruleset added earlier, e.g. SnortReg

Ruleset Policy
Balanced

The exact name of this option varies by ruleset.

Categories
Leave this as-is.

If a policy is selected, there is no need to select any categories.
Click OK
Click to start the instance

See also

Interface Settings

Testing Phase¶

Nearly all Snort configurations will detect traffic which is valid and not malicious, also known as “false positive” detections. This is normal because every network environment is different, there is no one-size-fits-all solution. A testing phase is critical to lower the rate of false positives in any given network environment.

Let Snort run for a short time and then click in the instance list row to view the alerts.

If there are no alerts, it can be tricky to determine if that is because nothing was detected, or if Snort is not processing traffic at all. This is why it’s better to start with a policy such as Balanced instead of using more lenient policies in this phase.

Note

This example uses a Balanced policy, which as the name implies, attempts to strike a balance between security and acceptable false positive rates. If numerous rules alert too much on valid traffic, try the Connectivity policy instead. If it doesn’t alert on known undesirable traffic, try the Security policy.

Most likely there will be several alerts in the window, but it’s up to the administrator if the alerts are valid or false positives. Typically, if the traffic is a part of required network or business operation then it should not generate an alert.

If the alerts are valid and unwanted traffic, then Snort is doing its job, but it won’t (and shouldn’t) act on anything yet.

If the alerts are false positives for valid, desirable, traffic, then there are several possible courses of action:

Disable the Rule

Click to disable and remove this rule from the ruleset.

This stops Snort from processing the rule entirely. This is more efficient than suppressing the rule, but not as flexible.

Suppress the Rule

Click to Add this Signature ID (SID) to the suppression list.

Requires a suppression list.

Suppress the Source

Click suppress under the source address to suppress alerts for this rule only from this source address.

Requires a suppression list.

Suppress the Destination

Click suppress under the destination address to suppress alerts for this rule only from this destination address.

Requires a suppression list.

Repeat the process, disabling or suppressing any rules that generate false positive alerts until Snort mostly detects unwanted traffic. It may not be possible to completely eliminate false positives indefinitely, but lowering the rate will reduce the likelihood of future matching causing significant disruptions.

Click to restart the Snort instance after making changes.

Tip

Continue this cycle for several days/weeks if feasible. Certain processes on hosts may only run once per day, week, and so on. Certain business tasks may only be performed once a month, per quarter, etc. It’s always possible to fix things later, but it’s more disruptive.

See also

Blocking Phase¶

Once the false positive detections have been reduced to acceptable levels, the Snort instance can be configured to Block on Alert.

Warning

Configuring Snort to block will cause all traffic for hosts in alerts to be dropped. Do this only after testing and ensuring false positives are minimal.

Navigate to Services > Snort 3, Interface Configuration tab
Click in the row of the instance to edit its settings
Configure the instance as follows:

Block on Alert
On

Kill States on Block
On

This will terminate open connections for blocked hosts, which is the most secure option.

Which Address to Block
Both

Tip

Consider creating a Pass Lists and selecting it in the instance settings to ensure Snort does not block critical hosts.
Click OK
Click to restart the Snort instance

Run with blocking on for some time to ensure it is working as intended.

If traffic is unexpectedly blocked, the first step is to check the alerts and see what triggered the block. If the block was from malicious traffic, inspect the host and ensure it wasn’t compromised and is otherwise safe.

If the alert was a false positive, adjust the rules or pass list so good traffic does not trigger the same alert again. After fixing the detection, click on the row of a Snort instance to Show Blocked Hosts and click to remove the block for that host.

See also

Optimization¶

The final phase is optimization to speed up detection and increase security.

The available options here vary by hardware, but consider setting the following:

Inline IPS: Set this to On and Snort will inspect traffic inline instead of passively monitoring traffic. This uses a lot more resources because Snort must process all traffic flowing through the interface(s) in question, but it is much more secure as traffic blocked due to alerts never makes it through to the hosts.
Hyperscan: Setting Fast pattern matcher to Hyperscan can greatly increase Snort performance on compatible hardware.

See also

Interface Settings