From owner-freebsd-chat@freebsd.org Thu May 31 10:13:50 2018 Return-Path: Delivered-To: freebsd-chat@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 06984EFD19C for ; Thu, 31 May 2018 10:13:50 +0000 (UTC) (envelope-from tdteoenming@gmail.com) Received: from mail-yb0-x244.google.com (mail-yb0-x244.google.com [IPv6:2607:f8b0:4002:c09::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 8BF2C7C105 for ; Thu, 31 May 2018 10:13:49 +0000 (UTC) (envelope-from tdteoenming@gmail.com) Received: by mail-yb0-x244.google.com with SMTP id i1-v6so7405211ybe.1 for ; Thu, 31 May 2018 03:13:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=/9YAXReHcIZ1vT91pp8R+H25j/CSZ+AmhwNU+TEmLeo=; b=o0HCGqW0OiH9EgVMdo2igopfTeiRzIr0cJzEes6FsrRUmjH8ASLLvHegWLjMBJM33N njrvb/5YjsedxrbtA+/kwK460pSSJXNlvlnJnPC5Z4EOkR4il62+809Fu/liQcnCDL7j nJ5yS6hgCNBOS3mKpy9elX2KTlb3yhDj1KedlaF66tA1pg+RRGUl8VYP3v0LU+iAxSqo mD6ZwvRXsfukX8y94RMZhLm3BMluHiQDrRych53EdetIqhseS9kU1WUVcVY94XQdk/Ac cOkkolx0l8OBRXWX5hwMoZPg+tXsfXXlzB5SnjFBm7wRp9Qp3pkGxa/5dfrV0F+Iy3Ap c1vQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=/9YAXReHcIZ1vT91pp8R+H25j/CSZ+AmhwNU+TEmLeo=; b=Yj8l26/NvF5xMA9hqK+3PPbteDyZ2E3h3iAk2mNgrS4tI9WuNGS76zJ8ThGGwkl+K6 vaI+2zMVfMDBVFZOnrt+H80gN8eUywOoQalVRWDD8q2lCCOsqQaTlokwhIUYVrpiCPBt ew0paW82L49+VbcxwlVkQ/2lOTeBr1Eccl9SWiI+UgtzMqxpitlVYY4r5FzmeGbcqHba SoFAe3mCEQB1gBDqD5sNIchmVfJIddHyyyAU/Bib1r6QlInzNvVqcEF6/3ewZO78gNn7 HaTlYUEDUykKenXrAUMhjbkdfDmi6hn7m+NnGrYa171twwxnT7pKRkiKWZPXYNRKDNFd BDuw== X-Gm-Message-State: ALKqPwffVtpUTZU6l2bFZhwmmVnRGO9PSdS6D1WgEzZr6KYmTk+ymiMp kl/nDmDwelBzp+++0VhRXIPctbbZcfxfYe7ksBDc X-Google-Smtp-Source: ADUXVKLZeb6wlGUVw5/MU+CRw+nspJUjb/NPDeilehXUkgmSBK+iOS/y+PgOjVxpBHJKDcPokwbbkmstr+77BE59iN4= X-Received: by 2002:a25:30d4:: with SMTP id w203-v6mr3439223ybw.357.1527761628765; Thu, 31 May 2018 03:13:48 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a25:cb42:0:0:0:0:0 with HTTP; Thu, 31 May 2018 03:13:48 -0700 (PDT) From: Turritopsis Dohrnii Teo En Ming Date: Thu, 31 May 2018 18:13:48 +0800 Message-ID: Subject: Is pfSense the Best Open Source Firewall/IDS/IPS in the World? To: freebsd-chat@freebsd.org Cc: Turritopsis Dohrnii Teo En Ming Content-Type: text/plain; charset="UTF-8" X-BeenThere: freebsd-chat@freebsd.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Non technical items related to the community List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 May 2018 10:13:50 -0000 Good Afternoon Everybody from Sunny Singapore! Four months ago, somewhere around 17th January 2018, I deployed my very first installation of pfSense firewall Community Edition version 2.4.2 on my 9-year-old home desktop computer (Intel Pentium Dual Core E6300 @ 2.8 GHz, Intel DQ45CB Motherboard, 6 GB RAM and 1 TB SATA Harddisk). More recently, on 25th April 2018, I have upgraded my home-based pfSense network security appliance to Community Edition version 2.4.3. As my primary focus is on Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), I have Snort installed as well. Since 17 Jan 2018, I observed that I have been getting very few and trivial Snort intrusion alerts. To my horror, I discovered that I did not enable all the Snort rules for all of my network interfaces. That was yesterday, 30th May 2018. Without wasting much time, I had swiftly enabled all the Snort rules for every one of my network interfaces. >From then on, I have been getting more exciting Snort intrusion alerts. My questions are: (1) Is pfSense, coupled with Snort, the best open source firewall/IDS/IPS in the world? (2) Is pfSense on par with commercial network security appliances, including but not limited to Cisco ASA, Cisco Sourcefire, Fortigate, SonicWall, etc? (3) Is Snort able to detect malware and ransomware before they reach the endpoints? Seems like Emerging Threats Pro (ET Pro) signatures at proofpoint.com are able to. How much are you required to pay for these signatures? (4) Where can I get quality guidance on configuring Snort in pfSense? I have searched Amazon AWS Cloud Marketplace and Microsoft Azure Cloud Marketplace. Only pfSense firewall is listed. I cannot find opnsense firewall anywhere. Same goes for GNS3 network simulator. pfSense firewall is based on FreeBSD 11.1. Please advise. Thank you very much. ===BEGIN SIGNATURE=== Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 30 Oct 2017 [1] https://tdtemcerts.wordpress.com/ [2] http://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming ===END SIGNATURE=== Time stamp: 31st May 2018 Thursday 6 PM Singapore Time GMT+8