This is an old revision of the document!
Table of Contents
PFSense - Suricata - Install Suricata
There are multiple parts to this:
Create Lists
Created a Pass List
Navigate to Services → Suricata → Pass List.
ALERT: DO NOT CREATE A PASS LIST!!!
Realistically, about the only time that you should require a Passlist is if you are running a honeypot host and you actually want bad stuff to find its way to that host.
In that situation, a passlist makes sense.
For about any other case, it does not.
Use custom PASS rules instead if you really need passlist functionality.
Created a suppress list
To suppress certain snort and ET signatures since initially there a bunch of False Positives.
This is accomplished under Services → Suricata → Suppress.
NOTE: This shows a suppresslist named WANSuppressList.
In order for this specific list to be used:
- Navigate to Services → Suricata → Interfaces.
- Edit the specific interface; in this example WAN.
- Within WAN Settings, go to Alert Suppression and Filtering and select this suppresslist.
- Click Save.
Rule categories
Choose what rule categories to enable:
Navigate to Services → Suricata → Interfaces → WAN Categories.