Protection
What gate42 blocks and watches from the first boot, where to see it, and how to adjust or switch it off.
Every gate42 from 2.0 on protects its networks with no setup. Two of OPNsense's own features are switched on and kept up to date:
| What it does | Where | |
|---|---|---|
| DNS blocking of malicious sites | For every network, gate42's DNS answers 0.0.0.0 for about 190,000 names of malware, phishing, scam and command-and-control sites (Hagezi's threat intelligence list) |
Services › Unbound DNS › Blocklists: the policy gate42 protection: malicious sites, every network |
| Intrusion detection on the LAN | Suricata checks the LAN's traffic against about 40,000 rules (Emerging Threats Open, abuse.ch) and raises an alert for attacks, exploits and infected devices. It does not block: see Block attacks (IPS) | Services › Intrusion Detection › Administration |
After the first boot
The firewall downloads the rules and the list by itself, a minute or two after its first boot, as soon as the WAN reaches the internet. Until then nothing is blocked or detected; gate42 tries again every hour. Afterwards both are updated once a day, each firewall at its own time (System › Settings › Cron: ids rule updates and gate42: update the DNS blocklists).
To check that it works: 1. Services › Intrusion Detection › Administration › Rules lists the rules (tens of thousands). 2. Reporting › Unbound DNS shows queries, and blocked ones once a device asks for a listed name.
Let a blocked site through
A business site wrongly listed? In Services › Unbound DNS › Blocklists, edit the gate42 protection policy and add the domain under Allowlist Domains, then Apply. The domain and its subdomains are allowed for every network.
Quiet a noisy alert
An alert you know is harmless (for example from your own scanner): in Services › Intrusion Detection › Administration › Alerts, open it and note its SID; in the Rules tab, find the SID and set it to disabled, then Apply.
Switch it off
- DNS blocking: untick the gate42 protection policy in Services › Unbound DNS › Blocklists, then Apply.
- Intrusion detection: untick Enabled in Services › Intrusion Detection › Administration › Settings, then Apply.
On a firewall with one network card only (no LAN), intrusion detection watches the WAN; its alerts then show the firewall's own address instead of the device.