PFsense with suricata and PFblocker

Networking & Firewalls
1

Hi,

Hoping someone can hep me or just explain to me why it is happening. I have PF blocker configured to block all IP addresses except for those located within canada and the US. I also have suricata setup on the router. My rule set for

ET CINS Active Threat Intelligence Poor Reputation IP group 69 - 05/08/2019-08:33:clock330:

ET DROP Dshield Block Listed Source group 1 - 05/07/2019-23:23:48

I am just curious how all these foreign IP addresses is hitting Suricata if pfblocker should prevent them from getting to the point suricata can scan the packets and where the IP address is coming from.

Any help would be greatly appreciated.

Thanks,

brad

2

this might help.

https://www.reddit.com/r/PFSENSE/comments/5y95lz/which_filters_first_suricada_or_pfblockerng/dep0357?utm_source=share&utm_medium=web2x

https://www.reddit.com/r/pfBlockerNG/comments/ai1m6b/which_happens_first_pfblocker_or_snortsuricata/

1 Like