Need you guys' help

A

amrogers3

Gawd
2FA
Joined
Nov 7, 2010
Messages
665
Trying to learn about network security and setting up a home network with emphasis on security.

Going to put up a untangle firewall and want to install inline Snort with a syslog server.

Anyone know of way to install snort inline on a router? Google searches provide results that are several years old. Doesn't seem like snort on a router is supported much anymore.

Any guidance would be most appreciated.

Thanks.
 
With untangle as the router/os it should be similar to this setup:
http://it.thelibrarie.com/weblog/2010/06/installing-snort-on-ubuntu-10-04/
and this is a quick guide setup for a older ubuntu os:
http://www.snort.org/assets/113/Snort_2.8.4.1_Ubuntu.pdf
Since Untangle and Ubuntu are both based off of Debian it should be pretty easy to modify the above and apply it to your untangle server/router.

How easy this is depends on how well you know Debian. I know enuogh that I could likely follow the directions above and apply it to the untangle OS. just that I haven't done it yet so I can't say exactly how it's done :(

That said I believe PFSense or smoothwall has a package that would automatically install snort for you. I know I did it once about a year ago with one of them.

***Edit***
Ye pointed out that untangle already comes with snort.
http://hardforum.com/showpost.php?p=1036400652&postcount=9
 
Last edited:
Thanks pwrusr, should have clarified my question a little bit.

I was going to buy a Linksys or ASUS wireless router and modify it using openWRT or DDWRT but I don't know enough about either of those packages to know if they support a snort install.

I googled it but doesn't seem like snort on a linuxed based wireless router has been supported for some time ~2007.

Just wanted to see if anyone out there has any experience with snort install on a router or if I should just go and install snort on a dedicated machine.

Thanks again, just trying to learn....
 
I would expect snort to be a little too demanding for most of the soho type routers that run ddwrt etc., there is a snort package for pfsense but I don't think you'll learn much from it, it's pretty straightforward and requires no config file modifications directly.
 
amrogers3 said:
Thanks pwrusr, should have clarified my question a little bit.

I was going to buy a Linksys or ASUS wireless router and modify it using openWRT or DDWRT but I don't know enough about either of those packages to know if they support a snort install.

I googled it but doesn't seem like snort on a linuxed based wireless router has been supported for some time ~2007.

Just wanted to see if anyone out there has any experience with snort install on a router or if I should just go and install snort on a dedicated machine.

Thanks again, just trying to learn....
Click to expand...

As aaronearles said, a standard home router won't cut it.
If you have a older PC with like a gig or more ram, P4 >2GHz, a >80gig hard drive and a couple network cards you can install untangle on that then install snort.
actually it looks like untangle uses snort as well:
http://www.untangle.com/Intrusion-Prevention/Tech-Specs
 
If you're looking to learn anything, I would try a standalone box, untangle and pfsense are cool for an all in one solution, but you wont learn much, maybe start with a dedicated box and then move it over to an integrated solution.
 
Thanks for the replies.

That is a good point. I has reservations about snort on a router. I didn't think it would be able to keep up. Probably wouldnt be able to use the full ruleset either.

From another post, I saw a setup I think would be good. I am going to buy two of these and install untangle on one and snort on the other.

http://hardforum.com/showpost.php?p=1036397498&postcount=15

Probably go with a thinner case tho. Probably the http://www.newegg.com/Product/Produ...52107&cm_re=SUPERMICRO-_-11-152-107-_-Product

I'll probably buy today if I don't hear any negatives on this setup.
 
aaronearles said:
If you're looking to learn anything, I would try a standalone box, untangle and pfsense are cool for an all in one solution, but you wont learn much, maybe start with a dedicated box and then move it over to an integrated solution.
Click to expand...

This is the only time i will agree with you! I agree with this post, if you really want to learn Try astaro, it's lots of work getting everything working and all the rules and how they work.

Untangle is nice, but you install it, and it runs and runs :)
 
pwrusr said:
With untangle as the router/os it should be similar to this setup:
http://it.thelibrarie.com/weblog/2010/06/installing-snort-on-ubuntu-10-04/
and this is a quick guide setup for a older ubuntu os:
http://www.snort.org/assets/113/Snort_2.8.4.1_Ubuntu.pdf
Since Untangle and Ubuntu are both based off of Debian it should be pretty easy to modify the above and apply it to your untangle server/router.

How easy this is depends on how well you know Debian. I know enuogh that I could likely follow the directions above and apply it to the untangle OS. just that I haven't done it yet so I can't say exactly how it's done :(

That said I believe PFSense or smoothwall has a package that would automatically install snort for you. I know I did it once about a year ago with one of them.
Click to expand...


Snort is already utilized in Untangle...no need to try to install it again as a separate package, it's already properly utilized/leveraged in Untangle.
 
amrogers3 said:
Thanks for the replies.

That is a good point. I has reservations about snort on a router. I didn't think it would be able to keep up. Probably wouldnt be able to use the full ruleset either.

From another post, I saw a setup I think would be good. I am going to buy two of these and install untangle on one and snort on the other.

http://hardforum.com/showpost.php?p=1036397498&postcount=15

Probably go with a thinner case tho. Probably the http://www.newegg.com/Product/Produ...52107&cm_re=SUPERMICRO-_-11-152-107-_-Product

I'll probably buy today if I don't hear any negatives on this setup.
Click to expand...

Do you need a rack server case ?

If not, im going to use this for my demo box,

http://www.newegg.ca/Product/Product.aspx?Item=N82E16811164129
 
YeOldeStonecat said:
Snort is already utilized in Untangle...no need to try to install it again as a separate package, it's already properly utilized/leveraged in Untangle.
Click to expand...

No way, really? Does it allow the full SNort ruleset?

Can I tweak or tinker with snort on untangle box? Dangit I wanted to do a seperate install just to learn how to do it.
 
Last edited:
amrogers3 said:
No sir, I don't need a rack server case but seems like it's the smallest footprint for my space. I can stack the rack boxes but that Linkworld box is too big. Probably more noisy too than the SUPERMICRO CSE-503-200B.
Click to expand...

the case i posted is VERY small! :)

i bet the 1.5" fan thats in the 1u rack case makes more noise than you think it does :)
 
I can't wait to get that sucker. Ordering it tonight.

Couple more questions.

1) what OS would be a good option for a snort install? Something not crazy hard to install but not insecure either.

2) What you guys think about this setup?

--- Gateway ---> untangle ---> wireless router ---> cisco ASA 5505 firewall ---> snort ---> open nas, syslog server

I know the 2nd install of snort and the cisco ASA is unnecessary but I want to learn how to install and configure those devices

I dont have ANY wired personal computers on my network. I have two laptops that I use mostly for browsing.
 
amrogers3 said:
I can't wait to get that sucker. Ordering it tonight.

Couple more questions.

1) what OS would be a good option for a snort install? Something not crazy hard to install but not insecure either.

2) What you guys think about this setup?

--- Gateway ---> untangle ---> wireless router ---> cisco ASA 5505 firewall ---> snort ---> open nas, syslog server

I know the 2nd install of snort and the cisco ASA is unnecessary but I want to learn how to install and configure those devices

I dont have ANY wired personal computers on my network. I have two laptops that I use mostly for browsing.
Click to expand...
Snort comes with Untangle.

i have 3 wireless laptops at home, what access point are you using ?
 
Wait, what? Untangle, then the Cisco ASA? Why not just keep the ASA at the edge (very low power usage), then have untangle running on-demand for lab usage. Also, while Untangle does have a snort module, rolling your own install is a good learning experience for working with the software. Then you could just run untangle on cheap PC hardware. What kind of switch are you running? I would run snort off a span port (all traffic going to a port or vlan gets routed here), so that way, you can play with IDS without affecting out the production network.

For OS, I would go with Debian or FreeBSD.
 
dashpuppy said:
Snort comes with Untangle.

i have 3 wireless laptops at home, what access point are you using ?
Click to expand...

I want to do a seperate install of snort just to learn how to do it. As for the router, I am not sure at the moment. I was thinking about using a router that I could install openWRT or DDWRT onto.

cymon said:
Wait, what? Untangle, then the Cisco ASA? Why not just keep the ASA at the edge (very low power usage), then have untangle running on-demand for lab usage. Also, while Untangle does have a snort module, rolling your own install is a good learning experience for working with the software. Then you could just run untangle on cheap PC hardware. What kind of switch are you running? I would run snort off a span port (all traffic going to a port or vlan gets routed here), so that way, you can play with IDS without affecting out the production network.

For OS, I would go with Debian or FreeBSD.
Click to expand...

The reason I wanted to put untangle on the frontend is because of its ability to stop and block so many things - ads, phish blocker, web filter, etc..

Not running a switch at the moment. I was going to use the Cisco ASA as my firewall/switch. Also I was going to put snort inline and not use span port functionality. Sound good?

Thinking about doing a BSD install just because I heard its a mofo to install but really secure.
 
amrogers3 said:
I want to do a seperate install of snort just to learn how to do it. As for the router, I am not sure at the moment. I was thinking about using a router that I could install openWRT or DDWRT onto.=
Click to expand...

PFSense makes it quite easy to install Snort (it's an add-on..as easy as clicking a few buttons in the add-on section of the web admin). And then you'll have a Snort tab in your web admin, you can go in and fiddle with it to your hearts content.
 
YeOldeStonecat said:
PFSense makes it quite easy to install Snort (it's an add-on..as easy as clicking a few buttons in the add-on section of the web admin). And then you'll have a Snort tab in your web admin, you can go in and fiddle with it to your hearts content.
Click to expand...

Stonecat, I was thinking about running a cisco ASA and then a snort box. here is what I am planning to do

gateway ---> untangle ---> router with DDWRT --> cisco ---> snort ---> internal devices (syslog, NAS)

I was going to put snort right behind untangle but you advised me untangle comes with snort built-in so I'll just put snort deeper into my network.

Reason for ASA is because I want to learn more about the cisco CLI commands.
 
Hi amrogers3,

The problem that I'm seeing here is that you're going to be behind 3 devices, which will make setup very complicated. I assume that when you say gateway, you're talking about a modem of some kind. Is the gateway doing any kind of IP routing? If so, you'll want to turn that off. Ideally, you want just one actual production router, and then you can have lab routers behind that.

I would recommend running your internet connection off the ASA, like this:

gateway (modem ?) --> Cisco ASA -> internal devices + lab setup.

I would recommend that you use the ASA CLI to configure everything. Cisco does not really do 'automated setup'. If you are going to run an ASA in production, you will need to understand all of the commands, it will not write firewall rules for you. You are going to make a lot of annoying mistakes, and it is going to be difficult. Cisco IOS/ASA do not hide anything from you. If you want to setup PPPoE, you need to understand MTU and TCP Max Segment Size and it will bite you in the ass if you don't know it fully (check my post history for an example), however, you are going to learn.

I would keep untangle, pfSense, Astaro as a lab topology. I would set up VMWare ESXi or something, and have various UTM/Firewall distros (just for testing, no real traffic passing through), as well as a linux install for snort. If you want to learn snort, setting it up from scratch, without Untangle helping you is going to be more challenging.

amrogers3 said:
I want to do a seperate install of snort just to learn how to do it. As for the router, I am not sure at the moment. I was thinking about using a router that I could install openWRT or DDWRT onto.



The reason I wanted to put untangle on the frontend is because of its ability to stop and block so many things - ads, phish blocker, web filter, etc..

Not running a switch at the moment. I was going to use the Cisco ASA as my firewall/switch. Also I was going to put snort inline and not use span port functionality. Sound good?

Thinking about doing a BSD install just because I heard its a mofo to install but really secure.
Click to expand...

Right now you have too many devices doing routing. If you want to have ad blocking and web filtering handled at the edge, then I would put untangle in transparent mode. Having three routed firewalls is going to make your network complicated to troubleshoot.

What I would do:

((Internet)) <-> Modem -> Cisco ASA -> UTM product (transparent mode) -> dd-wrt router (set up as wifi access point only, you can use all ports on it as a switch)

By the same token, just use one snort install. If you are going to have it inline, then that adds a third box that can fail, and that you have to deal with (and buy, and buy electricity for).

FreeBSD can be quite secure. Ultimately, the OS is only as secure as the administrator.
 
Last edited:
Great insights and feedback cymon. I added my comments below.

cymon said:
Hi amrogers3,

The problem that I'm seeing here is that you're going to be behind 3 devices, which will make setup very complicated. I assume that when you say gateway, you're talking about a modem of some kind. Is the gateway doing any kind of IP routing? If so, you'll want to turn that off. Ideally, you want just one actual production router, and then you can have lab routers behind that.
Click to expand...

That is correct. This is my network now

uverse router ---> wireless laptops

Very simple setup, much like the typical home network. Not much security at all.

I would recommend running your internet connection off the ASA, like this:

gateway (modem ?) --> Cisco ASA -> internal devices + lab setup.

I would recommend that you use the ASA CLI to configure everything. Cisco does not really do 'automated setup'. If you are going to run an ASA in production, you will need to understand all of the commands, it will not write firewall rules for you. You are going to make a lot of annoying mistakes, and it is going to be difficult. Cisco IOS/ASA do not hide anything from you. If you want to setup PPPoE, you need to understand MTU and TCP Max Segment Size and it will bite you in the ass if you don't know it fully (check my post history for an example), however, you are going to learn.
Click to expand...

I know CLI is going to be a pain to setup but I want to learn how to do it. I know a fair bit of networking to get into trouble. Im planning on buying a book to help me through the problems. If you could recommend a good beginner's book, that's even better.

I would keep untangle, pfSense, Astaro as a lab topology. I would set up VMWare ESXi or something, and have various UTM/Firewall distros (just for testing, no real traffic passing through), as well as a linux install for snort. If you want to learn snort, setting it up from scratch, without Untangle helping you is going to be more challenging.
Click to expand...

I found out from previous poster that untangle has snort built-in. That is the reason I was putting snort deep into my network. I didn't want to run snort right behind the untangle firewall. I don't have the hardware to implement that setup at the moment but that is something I can do down the road. Maybe add in a couple honeypots too ;)

Right now you have too many devices doing routing. If you want to have ad blocking and web filtering handled at the edge, then I would put untangle in transparent mode. Having three routed firewalls is going to make your network complicated to troubleshoot.

What I would do:

((Internet)) <-> Modem -> Cisco ASA -> UTM product (transparent mode) -> dd-wrt router (set up as wifi access point only, you can use all ports on it as a switch)

By the same token, just use one snort install. If you are going to have it inline, then that adds a third box that can fail, and that you have to deal with (and buy, and buy electricity for).

FreeBSD can be quite secure. Ultimately, the OS is only as secure as the administrator.
Click to expand...

Not sure what you mean by one snort install. I was only going to use one snort box on my network to monitor my internal devices.

Also, I was going to attempt snort install on BSD OS. I say attempt because I have no experience with BSD.

so how about this setup?

uverse router ---> ASA ----> untangle transparent mode ----> ddWRT router ---> snort --->switch ----> log server, NAS
 
You will have to disable NAT on the uverse router, if possible.

If Snort is going to run on a dedicated box, that box will need to be set up on a span port (alternatively, you can put a FastEthernet hub in between the untangle box and the switch, and hook the snort IDS box into the hub).

The dd-wrt router is just going to be doing wifi access, right?

Regarding security:

Right now, you have a NAT router, which is going to block all incoming services by default. Since there's no publicly-accessable services running, the only way you are going to get attacked is by a virus coming in over http or email. Untangle does have a virus scanner (in the paid edition, it has Kaspersky). ClamAV (the free edition) has a pretty terrible detection rate.

Keep in mind that no virus scanner is 100% effective, especially with new viruses coming out. Don't count on Untangle to catch everything. Run as non-admin users on your desktop computers, which will prevent many viruses from installing (unless they have a privledge escalation), and have a local AV on each PC (using a different detection engine, suck as MSE).
 
cymon said:
You will have to disable NAT on the uverse router, if possible.

If Snort is going to run on a dedicated box, that box will need to be set up on a span port (alternatively, you can put a FastEthernet hub in between the untangle box and the switch, and hook the snort IDS box into the hub).

The dd-wrt router is just going to be doing wifi access, right?
Click to expand...

Correct.

Regarding security:

Right now, you have a NAT router, which is going to block all incoming services by default. Since there's no publicly-accessable services running, the only way you are going to get attacked is by a virus coming in over http or email. Untangle does have a virus scanner (in the paid edition, it has Kaspersky). ClamAV (the free edition) has a pretty terrible detection rate.

Keep in mind that no virus scanner is 100% effective, especially with new viruses coming out. Don't count on Untangle to catch everything. Run as non-admin users on your desktop computers, which will prevent many viruses from installing (unless they have a privledge escalation), and have a local AV on each PC (using a different detection engine, suck as MSE).
Click to expand...

Ok, so would it be better to:
1) take out untangle and only run the ASA as my firewall
2) take out the ASA and run untangle as my firewall
3) run them both in a serial connection ---> ASA ---> untangle ---> router
4) use a different firewall other than untangle or ASA

As for snort, I don't need a span port switch because I have a box with 2 nics.

Where on the network should I place snort? This seems like a bit of overkill but I'll do just to learn if it will work:
((uverse router)) --> ASA --> untangle(dual nic box) --> snort(dual nic box) --> router ---> switch ---> internal devices
 
I'd bypass the NAT of the UVerse router, you can use your own router and effectively DMZ it, which in that funky 2Wire UVerse router basically passes the public IP address to the WAN port of your own router.

I'm not a fan of multiple routers. If you want that Cisco in there for some reason, and you want Untangle..just run Untangle with a single NIC and use it in transparent bridged mode.

If you want to learn Cisco stuff...use the Cisco. Personally for a home setup, I'd go for the simplicity of just running a single firewall/edge device.
 
cymon said:
Right now, you have a NAT router, which is going to block all incoming services by default. Since there's no publicly-accessable services running, the only way you are going to get attacked is by a virus coming in over http or email. Untangle does have a virus scanner (in the paid edition, it has Kaspersky). ClamAV (the free edition) has a pretty terrible detection rate.

Keep in mind that no virus scanner is 100% effective, especially with new viruses coming out. Don't count on Untangle to catch everything. Run as non-admin users on your desktop computers, which will prevent many viruses from installing (unless they have a privledge escalation), and have a local AV on each PC (using a different detection engine, suck as MSE).
Click to expand...

But Untangles Spyware Blocker module is actually leveraging a lot of different technologies and ends up being quite effective, ClamAV isn't the only thing it leverages.
 
Feedback is much appreciated. Thanks for the replies.

So the reason for two routers is that I want a router (uverse) for people who visit (unsecured laptops/devices) and I want a second router behind a firewall for my personal secured laptops. I would like to be able to detect any attacks on my internal secured network.

I really just want to use the network to learn so the best configuration that will allow to implement all these devices is what my goal is. Overkill and unnecessary? Probably. But I think it will very cool to get this all working together.

No sure what transparent mode is and how to implement that but I plan on utilizing dual nic computers to allow pass through of traffic. Not sure I need a transparent mode, but again, I'm new at this so I might be wrong.

OK, so having said all that, what is the best configuration to implement:
- two routers
- cisco ASA firewall
- untangle
- snort
- syslog server
- radius server
- nas server
 
A single firewall can handle both networks. The Internet connection is the lowest security, the guest network is slightly higher security, and the internal (secured) network is the highest. In Cisco ASA terms, the internet connection is security0, the guest network is security50, the internal network is security100. Firewalls will automatically block all traffic from a low security network to a high security network. For instance, guests and Internet users will not be allowed (by default) to connect to any host in the internal network.

Firewalls can operate in two modes: routed or transparent. Routed means that the device has an IP address. Traffic passes from one network (192.168.1.1 255.255.255.0) to another network (say, the HardForum web server, which is 75.126.99.220, located on network 75.126.0.0 255.255.0.0). To send traffic from your computer, (which is on a distinct IP network from HardForum.com), the traffic has to pass through a router, let's say it's at 192.168.1.1. This is how a routed firewall works.

A transparent firewall is different. A transparent firewall doesn't have an IP address. It reads the stream of packets passing through it. However, there's no data addressed to the transparent firewall. The transparent firewall doesn't move packets between networks.

Snort is based around capturing packets. Snort is not designed to act as a router. Setting up a span port or a hub is the easiest way to deploy a dedicated Snort install, as configuring a transparent firewall on linux (perhaps using iptables or the like) would be severly non-trivial.

I would hook the ASA directly up to the Internet, and do NAT and QoS on the ASA. Do you want web filtering for the internal and guest networks, or just the internal network?

If you want web filtering on internal AND guest networks

-Configure Untangle in routed mode. Assign the Cisco ASA's inside interface an ip address of 192.168.0.1 255.255.255.0. Assign the Untangle outside interface the IP 192.168.0.2 255.255.255.0. Set the Untangle default route to 192.168.0.1. This will route all traffic destined to the Internet to the ASA. Create routes on the ASA directing all traffic to networks 192.168.1.0 255.255.255.0 and 192.168.2.0 255.255.255.0 to 192.168.0.2. This will direct all traffic to the guest and internal networks to the Untangle box. You will need 3 nics on the untangle box. Configure the guest network interface with an IP of 192.168.1.1 255.255.255.0. Configure the inside network interface with an IP of 192.168.2.1 255.255.255.0. You can use different IPs, just make sure that the (asa inside, untangle outside) interfaces, (untangle guest network), and (untangle internal network) are all on different networks (also called subnets). If you are going to do QoS, feel free to have Untangle do tagging and classification. Have the ASA implement the actual policing or traffic-shaping.

-If you only want web filtering for the internal network, OR you only want web filtering for the guest network.

Set the Untangle firewall to transparent mode. Place it between the desired interface on the ASA (the ASA does all routing this case). Configure web filtering as desired.

You mention RADIUS. I assume that you are interesting in setting up administrative users on the ASA, perhaps using RADIUS to manage VPN users. Are you interested in requiring a username/password to access the network (this is referred to network access control), something like how a wifi hotspot asks you for a login before you can connect?

Either way you set it up, the two routers will be the Cisco ASA and the Untangle box. Let's discuss the snort config and NAS setup after we get the basics figured out.

YeOlde, dashpuppy: Read the OP's posts. A major concern is the OP learning to set up networks like this.
YeOlde: I understand that Untangle uses multiple technologies for virus/spyware blocking. However, for this exercise, I think we need to focus on what the _free_ untangle offers, unless the OP is interested in forking over 40$ a month (yes, I understand the OP is buying an ASA. If the OP doesn't buy smartnet or the IPS module, then there's no monthly fee for the ASA).

Untangle said:
Uses dozens of custom-tuned community blacklists in addition to Untangle's Virus Blocker technology, based on ClamAV
Click to expand...

So in the free, OSS edition, the only actual scanning is being done by ClamAV.
 
Last edited:
cymon said:
YeOlde: I understand that Untangle uses multiple technologies for virus/spyware blocking. However, for this exercise, I think we need to focus on what the _free_ untangle offers, unless the OP is interested in forking over 40$ a month (yes, I understand the OP is buying an ASA. If the OP doesn't buy smartnet or the IPS module, then there's no monthly fee for the ASA).



So in the free, OSS edition, the only actual scanning is being done by ClamAV.
Click to expand...

I am talking about the free version. What you're failing to consider is what powers each virtual module of Untangle. Example...the Spyware Blocker...a module included in the FREE Untangle, utilizes a lot more than just ClamAV, as I mentioned above. I agree ClamAV all by itself as a desktop scanner is quite useless. However, combined with other technologies that are leveraged *built into the FREE version of Untangle) to power the Spyware Blocker, the ending result is quite an effective package. I'm an Untangle reseller and have been working with Untangle since the early version 5 days, and have many installs of it out there, I'm quite familiar with it.
 
cymon said:
A single firewall can handle both networks. The Internet connection is the lowest security, the guest network is slightly higher security, and the internal (secured) network is the highest. In Cisco ASA terms, the internet connection is security0, the guest network is security50, the internal network is security100. Firewalls will automatically block all traffic from a low security network to a high security network. For instance, guests and Internet users will not be allowed (by default) to connect to any host in the internal network.

Firewalls can operate in two modes: routed or transparent. Routed means that the device has an IP address. Traffic passes from one network (192.168.1.1 255.255.255.0) to another network (say, the HardForum web server, which is 75.126.99.220, located on network 75.126.0.0 255.255.0.0). To send traffic from your computer, (which is on a distinct IP network from HardForum.com), the traffic has to pass through a router, let's say it's at 192.168.1.1. This is how a routed firewall works.

A transparent firewall is different. A transparent firewall doesn't have an IP address. It reads the stream of packets passing through it. However, there's no data addressed to the transparent firewall. The transparent firewall doesn't move packets between networks.
Click to expand...

OK, I follow you on this. I didn't know it was called transparent mode but I know what you are talking about.

Snort is based around capturing packets. Snort is not designed to act as a router. Setting up a span port or a hub is the easiest way to deploy a dedicated Snort install, as configuring a transparent firewall on linux (perhaps using iptables or the like) would be severly non-trivial.
Click to expand...

I tried to look up transparent mode and snort on google. I remember reading about snort-inline. I believe someone got that working on a linux install. I'll have to do a little more digging. Worst case, I can get a switch and enable port mirroring.

I would hook the ASA directly up to the Internet, and do NAT and QoS on the ASA. Do you want web filtering for the internal and guest networks, or just the internal network?
Click to expand...

I just want to set up web filtering for the internal network.

If you want web filtering on internal AND guest networks

-Configure Untangle in routed mode. Assign the Cisco ASA's inside interface an ip address of 192.168.0.1 255.255.255.0. Assign the Untangle outside interface the IP 192.168.0.2 255.255.255.0. Set the Untangle default route to 192.168.0.1. This will route all traffic destined to the Internet to the ASA. Create routes on the ASA directing all traffic to networks 192.168.1.0 255.255.255.0 and 192.168.2.0 255.255.255.0 to 192.168.0.2. This will direct all traffic to the guest and internal networks to the Untangle box. You will need 3 nics on the untangle box. Configure the guest network interface with an IP of 192.168.1.1 255.255.255.0. Configure the inside network interface with an IP of 192.168.2.1 255.255.255.0. You can use different IPs, just make sure that the (asa inside, untangle outside) interfaces, (untangle guest network), and (untangle internal network) are all on different networks (also called subnets). If you are going to do QoS, feel free to have Untangle do tagging and classification. Have the ASA implement the actual policing or traffic-shaping.

-If you only want web filtering for the internal network, OR you only want web filtering for the guest network.

Set the Untangle firewall to transparent mode. Place it between the desired interface on the ASA (the ASA does all routing this case). Configure web filtering as desired.

You mention RADIUS. I assume that you are interesting in setting up administrative users on the ASA, perhaps using RADIUS to manage VPN users. Are you interested in requiring a username/password to access the network (this is referred to network access control), something like how a wifi hotspot asks you for a login before you can connect?
Click to expand...

Correct, I would like to use RADIUS to provide network access control, exactly as you mentioned with the wifi hotspot.

Either way you set it up, the two routers will be the Cisco ASA and the Untangle box.
Click to expand...

I thought I could set it up so untangle will not provide routing in transparent mode.

Let's discuss the snort config and NAS setup after we get the basics figured out.

YeOlde, dashpuppy: Read the OP's posts. A major concern is the OP learning to set up networks like this.
YeOlde: I understand that Untangle uses multiple technologies for virus/spyware blocking. However, for this exercise, I think we need to focus on what the _free_ untangle offers, unless the OP is interested in forking over 40$ a month (yes, I understand the OP is buying an ASA. If the OP doesn't buy smartnet or the IPS module, then there's no monthly fee for the ASA). So in the free, OSS edition, the only actual scanning is being done by ClamAV.
Click to expand...

Another problem I have been thinking about is how to put a firewall in between the uverse modem and the wireless router. Is double NATing going to be a problem? My network setup may not work as planned. May have to redesign network layout to accomplish what I want to do. Maybe for the sake of learning I am over complicating my network.

The only reason I am trying to set this network up is to learn but I would like to embed security in the design.

So what I would like to do is have two separate wireless networks. One for visitors(External Network), one for my own personal laptops(Internal Network). Also would like to create a Syslog server, NAS server, RADIUS server, and implement Snort on the Internal Network. I would also like to implement a Cisco firewall to learn and configure through the CLI.

I would also like to include in my Internal Network: web filtering, virus blocker, spam blocker, ad blocker, phish blocker, and spyware blocker functionality as is included in untangle.

Since I believe my design is broken, what is the best configuration to accomplish this task?
 
Here is my latest design
Code: 
modem ->  untangle firewall/router --> bridge mode snort --> CISCO ASA/SWITCH ----------------> DMZ -> external file server
                				|		      |--> internal net -> NAS
                				|		      |--> Private AP
                				|		      |--> workstation(s)
      		                   optional syslog server

OK, just a couple more issues and I think I will be ready to begin the build.

Let me try and discuss my logic here

1) I am much more interested to see what is going on behind the firewall on the internal side. That way I will know if anything got through the firewall. I would like to put Snort behind untangle. I think by putting it outside the firewall I am going to be inundated with alerts. I know untangle utilizes snort but I want to try the real deal.

2) ASA/switch will not perform NATing. ASA/switch will only route traffic and act as a firewall to separate the trusted internal network from the DMZ.

This design will let me segregate network and utilize all the devices I wanted to implement.

Any feedback?
 
looks like a mess... to me this says:

nat -> utm (doublenat) -> redundant ips -> redundant firewall -> switch

I would decide now, whether you want to use untangle, or individual components on your "production network", and either go with the ASA and snort combo, otherwise, just use untangle and save the snort and asa for your lab environment. and throw your syslog server on your internal network instead of some dedicated interface off another box.

You're not going to get any hits on the second firewall or second ips, so they're useless in this config. Why not throw them on a lab environment behind the dmz of the first firewall?
 
No double NAT here. Untangle is NATing. Snort transparent. Doesn't have to be a firewall next, could be a switch, either way it is only routing.
 
Untangle does use snort rules but it's only a small chosen set. I think it might be possible to use the VRT/ET rules for snort but you'll have to update it yourself. It won't be automatic. There are postings on the Untangle forums to discuss how to do it.

Pfsense doesn't have snort built in but you can download several packages including an add-on snort module. However it won't be inline so it'll be primarily an IDS and not a IPS. Some rules are blocked but I think are some things that slip through. There is someone currently working on an inline snort module but the progress is slow.

If you want snort on a home (soho) router there's http://packetprotector.org/ It uses inline snort on openwrt for a small select amount of models. Because you're using a home router it won't be as powerful and you'll end up using very few rules. Snort's Emerging Threat rules requires a lot of power. A Pentium 4 2.0 ghz has problems handling it.

I have used both Untangle and Pfsense. Each are good but have certain weaknesses preventing it from being the best.

Untangle has some visibility issues with it's firewall and IDS. Incoming blocked connections won't be logged. Secondly, Snort rules rarely are triggered.

Pfsense is great but it's more taxing on a low end computer if you have squid, dan's gaurdian, and the snort installed. Those three add-on packages gives Pfsense the same functionality as Untangle. I had issues with squid randomly crashing.
 
Last edited:
Rashidan said:
Untangle does use snort rules but it's only a small chosen set. I think it might be possible to use the VRT/ET rules for snort but you'll have to update it yourself. It won't be automatic. There are postings on the Untangle forums to discuss how to do it.

Pfsense doesn't have snort built in but you can download several packages including an add-on snort module. However it won't be inline so it'll be primarily an IDS and not a IPS. Some rules are blocked but I think are some things that slip through. There is someone currently working on an inline snort module but the progress is slow.

If you want snort on a home (soho) router there's http://packetprotector.org/ It uses inline snort on openwrt for a small select amount of models. Because you're using a home router it won't be as powerful and you'll end up using very few rules. Snort's Emerging Threat rules requires a lot of power. A Pentium 4 2.0 ghz has problems handling it.

I have used both Untangle and Pfsense. Each are good but have certain weaknesses preventing it from being the best.

Untangle has some visibility issues with it's firewall and IDS. Incoming blocked connections won't be logged. Secondly, Snort rules rarely are triggered.

Pfsense is great but it's more taxing on a low end computer if you have squid, dan's gaurdian, and the snort installed. Those three add-on packages gives Pfsense the same functionality as Untangle. I had issues with squid randomly crashing.
Click to expand...


Thanks for the post Rashidan.

My initial idea was to run snort either in-line or on a wireless router via the packetprotector package. If configuring Snort to run inline isn't possible at the moment, looks like that isn't going to happen. So due to the inability to run Snort in-line and the lack of the full Snort ruleset on a router I need to figure out a different solution.

I want to run pfSense and Snort but I may need a switch via port mirroring to do it.

so I think what I want to do is...

Code: 
pfSense --- Cisco ASA(firewall, routing only no NAT)------Snort, syslog server
                         |       |----------DMZ-------->file server, web server
                         |-----------------wireless router, NAS

So the ASA will form 3 different networks. Hope isn't a strategy but, hopefully, the 1.8 GHZ superMicro Atom board will be able to run the full Snort ruleset.
 
I have read a few Snort inline install guides for linux based OSs. Can anyone recommend any books or online guides for installing Snort inline on BSD?
 
You must log in or register to reply here.
Back
Top