Hardening PFSense System: Detecting Port Scans with Snort

This assignment provides a comprehensive guide to hardening a PFSense system using Snort, an intrusion detection system. The student starts by configuring Snort within the PFSense interface, including starting the service, downloading and updating the latest community rules. The guide details the steps for setting up Snort, configuring global settings, updating rules, and adding a Snort interface. To test the configuration, the student uses Kali Linux to perform a port scan, demonstrating how Snort detects such activities. The assignment includes screenshots to illustrate each step, along with a detailed explanation of hardening, Snort's functionality, and the rationale behind using Snort in this scenario. The document also briefly mentions other methods for hardening PFSense. The assignment concludes with a bibliography of relevant sources.

Running head: RESEARCH METHODS FOR HARDENING PFSENSE
Research methods for hardening PFSense
Name of the Student
Name of the University
Author’s Note

1
RESEARCH METHODS FOR HARDENING PFSENSE
Step#1: Staring the snort GUI for configuration –
We need to navigate to services> Snort for starting the snort from the pfsense menu.
Step#2: Setting up the snort –
The global setting should be opened and the new set of rules should be downloaded for the
management of the merging threats and a unique code should be entered. More than one rule scan also
be set but it needs a paid subscription. After setting the desired rules the interval should be set and new
updates should be checked for enabling the package rules. Update interval can also be used for
automatically updating the configuration and checking the emerging threats for any types of updates in
the posted rule.

2
RESEARCH METHODS FOR HARDENING PFSENSE
Step#3: Updating the rules
In the update tab status of the download can be checked and new updates can be downloaded. If there
is a new set of rules available in the website the update is downloaded and installed in the client
machine configured with snot rules. The update is checked with the comparison of MD5 value of the
local file with the file in the remote server. If the local and the remote file does not match the new file is
downloaded. There is also a FORCE option that can be used to forcefully update the snort rules without
performing the MD5 hash test.

3
RESEARCH METHODS FOR HARDENING PFSENSE
Step#4: Adding Snort Interface
For the addition of the snort interface the + icon is needed to be clicked and the drop down option
should be used for finishing the interface configuration. The save option should be used for the
configuration of the snort interface. If there is any warning then the rules must be checked and the
interface must be configured again.

4
RESEARCH METHODS FOR HARDENING PFSENSE

5
RESEARCH METHODS FOR HARDENING PFSENSE
Step #1: Opening portscan using Kali linux
The nmap is used for opening the portscan and firstly a ping scan is used for finding the open ports and
the service running on the port of the targeted IP address.
The scan can be specified with the different set of commands such as

6
RESEARCH METHODS FOR HARDENING PFSENSE

7
RESEARCH METHODS FOR HARDENING PFSENSE
Bibliography
Allen, L., Heriyanto, T., & Ali, S. (2014). Kali Linux–Assuring security by penetration testing. Packt
Publishing Ltd.
Gaddam, R., &Nandhini, M. (2017, March). An analysis of various snort based techniques to detect and
prevent intrusions in networks proposal with code refactoring snort tool in Kali Linux
environment. In Inventive Communication and Computational Technologies (ICICCT), 2017
International Conference on (pp. 10-15). IEEE.