Home Network Security

Networking & Firewalls
1

I run FreeBSD 14.2 on my router using pf to filter traffic outbound traffic. I leverage DNS and IP block lists and am looking to integrate additional components to further secure the network. I’m planning to add crowdsec to augment my IP blocks.

I have pflog interfaces that allow me to detect what traffic is being blocked where, so I can see if something hits an IP block and which one. Though, I must admit that my IP blocks don’t appear to be blocking much if anything. I suppose that is a good thing, I don’t have any malicious traffic on the network, yet.

I’ve used squid in the past, well over 5 years ago to do SSL bumping, but have gotten away from that due to the overhead and inability to update embedded devices.

I’ve also used suricata in the past on top of the ELK stack and while it gave me a great interface with plenty of logs and data, I stopped using it because it required a ton of effort for marginal gains (investigate the logs looking for something, and then update my rules accordingly).

I simply want to secure my network ‘more’, whatever that means is rather subjective. And, to complicate matters, it is difficult to say whether my IP and DNS blocks are helpful or more of a hindrance (some websites may not work requiring me to allow them, but this has mostly stabilized after the initial setup).

About 2 or so years ago, I stumbled upon zenarmor and it seems like it does what squid did and so it would be filling a desire that has been unmet for sometime. I believe LTS uses a different platform, zorus, so this question would be more suited for the home office users.

Additionally, if I were a bad actor, I would tunnel out all of my traffic over https (443) and go to Amazon AWS and then it would appear normal just like any other traffic. If it were going to a suspicious IP, then it would easily trip an alarm or hopefully be blocked too. One additional note is that I restrict traffic by time of day so that it would be slightly harder for something to run in the middle of the night. But again, if I were a bad actor, I might simply program this into the malware by sending traffic at a certain time of the day when a user is most likely to be there to hide it with ‘normal’ traffic.

This leads me to believe that additional firewall rules are not going to add much value, it is extremely low hanging fruit that might catch the most basic of bad actors. So, what other options might be useful? Are the other tools I mentioned above useful to others and are there any analogies or metrics that can back those claims up? Should I look at installing agents on the endpoints themselves such as wazuh?

2

Device level security will always be better in the end. Trying to do security on the firewall is a nightmare.

3

Most threat actors now are using domains with Let’s Encrypt certs and the more advances ones are using Cloudflare tunnels. Firewalls are just no suited to protect systems against modern threats. Focus on the endpoint, limit what extensions are in your browser, and keep systems and browsers up to date.

1 Like
4

Ok. Do you have any open source recommendations for endpoint protection? Devices on my network include FreeBSD, Linux, Apple, Windows, Android, and iOS devices, pretty much the entire spectrum.

5

There is not much out there in the open source world besides Wazuh and Security Onion

6

I’d like to AC-Hunter CE to this list, or, if you do not like the UI and just want the detection, just use RITA, which is the engine under the hood of AC-Hunter. This tool does not get a lot of attention, but for me it was worth the effort of tuning it. The tooling is free and RITA is OSS.

This tool uses some of the logs produced by Zeek to detect beaconing traffic (also over DNS), long running connections, and unusual agent strings.
The idea is that C2-traffic would show up in these detections. Active Countermeasures offer free tutorials and blogs showing how to use this effectively.

Admittedly it will create a barrage of detections in the beginning and you need to use filterns in Zeek to tune it to you traffic mix. In the process you will learn a lot about your network and you will find things you want to change, e.g. using you own DNS and NTP servers everywhere instead of direct outreach to DNS and NTP.
After a while of tuning you will just see things that are new in you network our things you want to do something about. The daily effort then is about 5 minutes.

In principle you could build this using Zeek plus something like ELK, Gravwell etc.

7

Thanks for the information, I will check it out.

The same could be true with a firewall that periodically blocks traffic for a period of time. Perhaps when blocking traffic by time of day, I generate a summary of the traffic and then evaluate it to see what is caught to establish a baseline.

Then, every night, I produce that summary report and if anything stands out, I investigate.

Secondly, in the summary report, I list long-running connections. I establish some sort of baseline and again trigger and alert if something is awry.

I used to use argus a while back to generate traffic reports, suricata might be overkill and I haven’t used that for awhile. I’ll have to see what I can use to produce that easily.

8

Zeek - the response is that short but I had to write more

9

Thanks, I configured it to listen on my pflog interfaces and it appears there is some traffic on pflog2, which is where all the LAN traffic that doesn’t match a rule gets logged before being silently dropped.

I need to do more research, but I am no longer getting an email summary of the traffic, perhaps because there is no longer a conversation since that is blocked traffic there is only a request, but no response coming back.

I don’t see any other traffic being dropped including my IP blocks, crowdsec blocks, etc. I suppose that is a good thing.

Now, I just need to make heads or tails of what is being dropped on pflog2 and why. It might be as simple as a design conflict where I configure all network traffic to be dropped between 12 am and 6 am and there may be some maintenance activities happening at that time which are being caught.

I guess I should also have indicated my motivation for tightening the network. I don’t believe bad guys would ‘get into’ my network, but rather, most likely, I would fall prey to a phishing attack of some sort, revealing some sensitive information, email address, phone number, address, username, password, etc. For that type of attack, that is where I would see value in blocking bad IPs or DNS names, but like anything else, the biggest factor is the person behind the machine. Secondly, the other type of attack I’d be concerned with would be installing a malicious app either on a mobile device or system. That can be minimized by doing some research before installing an app and only installing from trusted sources.

10

you can use ELK or Gravwell and ingest our pflogs to make them universally searchable.

You could use pihole as your DNS resolver.

If you would use pfSense as your firewall you could use pfBlocker-ng to block domain names and IPs based on threat feeds and geolocation. Feeding the firewall logs into e.g. Gravwell is simple and there is a kit for pfSense logs that provides dashboards and searches.

There is lots of advice available how to avoid that.
Additionally you can use MVT to inspect you smartphone for IoCs of spyware and AC-Hunter to detect C2 traffic, as well as periodically matching threat feeds to Zeek logs in ELK or Gravwell. This way you get aware when a device got infected.You can also load threat feeds into the Zeek Intel framework so that Zeek produces notifications in the notification logs accordingly.

This is just not theoretically possible. I have all this in place running in background.

1 Like