Firewall IDS Explained: What Threats Can It Stop? [YouTube Release]

Chapters
00:00:00 Intro to IDS/IPS
00:00:32 IDS Pattern Matching Basics
00:02:17 Snort Rule Triggers and Why
00:5:42 Encryption TLS SNI Detection Limits
00:07:13 Effectiveness Against Modern Threats

xMAXIMUSx · August 12, 2024, 10:48pm

Tom opening a can of worms on this one. Let me go make some popcorn and watch the flood of highly opinionated comments come in.

RonV42 · August 13, 2024, 11:43am

I agree with Tom, the value proposition lately has been diminishing. Snort does have some “helpers” that know about behaviors of HTTP servers, port scanning etc that can be leveraged in rules to make them a bit more robust in detecting various attacks on the network.

Myself I run in “Inline” mode and have the rules updated by the IDS configuration in pfSense to update alerts into drops for the categories I am comfortable with. Also, I selected the pre-defined policy selection of “Security” which will select the category of “Snort” rules that are least likely to generate false positives while still providing some good IDS/IPS support for my sever VLAN.

As for the script kiddies out there, I created two aliases and WAN block rules for the persistent subnets or addresses that seem to be pests that aren’t in any of the ET-emerging or SNORT lists. By analysis the firewall logs quickly each morning with my Graylog dashboard (thanks Tom) I am able to see anything captured by those additional firewall rules or the ones that escaped and were captured by SNORT. There is one IP range in Australia that every two to three days floods my server network with port scans. By putting their address into the firewall alias and the rule to always block on the wan port I save some firewall/snort CPU and my state tables.

From my perspective I still takes a bit of time each day or weekly to make sure the system is operating correctly, and I still see value here to continue to use SNORT as my IDS/IPS. Heck I am even getting my son involved with it and I assume one day he would also become a network guru on these types of systems.