Deciso OPNsense / Netgate pfSense

About the Device

OPNsense is an open source, easy-to-use and easy-to-build FreeBSD based firewall and routing platform. OPNsense includes most of the features available in expensive commercial firewalls, and more in many cases. It brings the rich feature set of commercial offerings with the benefits of open and verifiable sources.

The feature set of OPNsense includes high-end features such as forward caching proxy, traffic shaping, intrusion detection and easy OpenVPN client setup.

pfSense is a firewall/router computer software distribution based on FreeBSD. The open source pfSense Community Edition (CE) is installed on a physical computer or a virtual machine to make a dedicated firewall/router for a network. It can be configured and upgraded through a web-based interface, and requires no knowledge of the underlying FreeBSD system to manage.

Device Information

Collection Method

Port Requirements

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

To configure OPNSense Device

1.  Login into OPNsense GUI with Admin credentials. Change Local Log settings as guided below.

2. Navigate to System > Settings > Logging, click Local Logging Options.

3. Select the following options in Log Firewall Default Blocks:

   1. Log packets matched from the default block rules put in the ruleset

   2. Log packets matched from the default pass rules put in the ruleset

   3. Log packets blocked by 'Block Bogon Networks' rules

   4. Log packets blocked by 'Block Private Networks' rules

4. Click Save to store the new settings.

To Send Firewall logs to CYBERHUB

1. Navigate to System > Settings > Logging/targets, click Destinations

2. Add New destination by clicking on + symbol.

3. In Edit Destination, select the following

   1. Select Enabled

   2. Transport - Select TCP

   3. Applications - Select filter and firewall

   4. Levels - Select all levels except debug

   5. Facilities - Select all

   6. Hostname - Provide CyberHub IP

   7. Port - 601

   8. Select rfc5424

   9. Description - Any useful description

4.Click Save and then Apply the settings.

To Configure pfSense Device

1. Login into pfSense GUI with admin credentials. Change Global Log settings as guided below.

2. Navigate to Status > System Logs > Settings, click General Logging Options.

3. Select the following:

   1. Log Message Format - syslog (RFC 5424, with RFC 3339 microsecond-precision timestamps)

   2. In Log Firewall Default Blocks, select the following

      1. Log Packets from Default Block Rules in the ruleset

      2. Log Packets from Default Pass Rules in the ruleset

      3. Log Packets from Block Bogon Networks Rules

      4. Log Packets from Block Private Networks Rules

4. Click Save to store the new settings.
   

To Send Firewall logs to CYBERHUB

1. In Settings, navigate to Status > System Logs, click Remote Logging Options.

2. Select the following:

   1. Select Enable Remote Logging

   2. Source Address - Keep it Default reflected value as “Any“

   3. IP Protocol - Select TCP.

   4. Remote Log servers - Provide <CyberHub IP:601>.

   5. In Remote Syslog Contents, select Firewall Events

3. Click Save to store the changes.

Integration Parameters

Parameters required from customer for Integration.