pfSense: Open Source Firewall dan Router

# Navigasi GUI:
# Firewall > Rules > [Interface]
# Aturan diproses TOP-TO-BOTTOM - urutan sangat penting!

# Contoh aturan dasar:
# Interface: WAN (Internet facing)
# 1. Block all (default)
# 2. Allow OpenVPN (UDP 1194) from any
# 3. Allow HTTP/HTTPS (TCP 80,443) to Web Server only

# Interface: LAN (Internal)
# 1. Allow all to any (default - trusted network)
# 2. Block specific hosts from internet
# 3. Allow management access from admin subnet only

# Lihat semua aturan yang aktif:
pfctl -sr

# Lihat aturan NAT:
pfctl -sn

# Lihat status tabel state:
pfctl -ss

# Contoh output pfctl -sr:
# pass in on wan proto tcp from any to 203.0.113.10 port 443 keep state
# pass in on wan proto udp from any to 203.0.113.10 port 1194 keep state
# block drop in on wan from <blocklist> to any
# pass in on lan from 10.0.0.0/24 to any keep state

# Alias - kumpulan IP/port/network yang bisa digunakan di aturan:
# Firewall > Aliases
# Contoh alias:
#   - WebServers: 10.0.0.10, 10.0.0.11, 10.0.0.12
#   - DBServers: 10.0.0.20
#   - AllowedCountries: ID, SG, JP (geoIP)
#   - BlacklistIPs: (dynamic, dari feed threat intel)

# Aturan dengan Alias:
# Action:   Pass
# Proto:    TCP
# Source:   LAN net (10.0.0.0/24)
# Dest:     WebServers (alias)
# Port:     443, 80
# Log:      Yes
# Descr:    Allow LAN to Web Servers

# Schedule-based rules (waktu tertentu):
# Firewall > Rules > Schedule
# Contoh: block social media jam kerja (08:00-17:00 weekdays)

# Navigasi: Firewall > NAT > Port Forward
# Contoh: forward port 443 (WAN) ke internal web server

# Konfigurasi:
# Interface:  WAN
# Proto:      TCP
# Dest.Addr:  WAN IP (203.0.113.10)
# Dest.Port:  443
# Redirect IP: 10.0.0.10
# Redirect Port: 443
# Descr:      HTTPS to internal web server

# Filter rule association:
# "Add associated filter rule" - otomatis buat aturan firewall
# untuk mengizinkan traffic yang di-forward

# Verifikasi dari luar:
curl -k https://203.0.113.10
# Jika berhasil → traffic melewati pfSense ke web server internal

# Navigasi: Firewall > NAT > Outbound

# Mode:
# 1. Automatic (default) - pfSense mengatur NAT secara otomatis
# 2. Hybrid - aturan otomatis + manual
# 3. Manual - kontrol penuh (advanced)

# Contoh konfigurasi manual:
# Interface:  WAN
# Source:     10.0.0.0/24 (LAN subnet)
# Dest:       any
# NAT Addr:   Interface Address (WAN IP)
# Static Port: NO (randomize source port untuk keamanan)

# Verifikasi NAT berfungsi:
# Dari client LAN, cek public IP:
curl ifconfig.me
# Output seharusnya IP WAN pfSense, bukan IP LAN

# Navigasi: Firewall > NAT > 1:1

# Contoh: Map 203.0.113.15 → 10.0.0.15
# External Subnet: 203.0.113.15/32
# Internal IP:     10.0.0.15
# Descr:           Email server 1:1 mapping

# Berguna untuk:
# - Mail server yang butuh koneksi keluar dengan IP konsisten
# - VoIP server yang butuh RTP port range besar
# - Game server dengan banyak port

# Navigasi: VPN > OpenVPN > Servers
# OpenVPN adalah pilihan terbaik untuk remote access VPN

# Konfigurasi dasar server:
# * Server Mode: Remote Access (SSL/TLS + User Auth)
# * Protocol: UDP (lebih cepat dari TCP)
# * Device Mode: tun (Layer 3)
# * Interface: WAN
# * Port: 1194
# * Encryption: AES-256-GCM
# * Auth Digest: SHA512
# * TLS Key: Auto-generate
# * IPv4 Tunnel Network: 10.0.8.0/24
# * DNS Server: 1.1.1.1, 8.8.8.8

# Generate client certificate:
# VPN > OpenVPN > Client Export
# Export format: .ovpn (OpenVPN config)

# Aturan firewall untuk OpenVPN:
# Firewall > Rules > WAN
# Pass proto UDP from any to WAN-IP port 1194

# Koneksi dari client:
openvpn --config client.ovpn
# Output:
# Initialization Sequence Completed
# IP: 10.0.8.6 → route ke jaringan internal aktif

# Navigasi: VPN > IPsec
# IPsec cocok untuk koneksi antar kantor (site-to-site)

# Phase 1 (IKE):
# * Authentication: Mutual PSK (atau Certificate)
# * Encryption: AES-256-GCM
# * DH Group: 14 (2048-bit)
# * Lifetime: 28800 seconds (8 hours)

# Phase 2 (IPsec SA):
# * Protocol: ESP
# * Encryption: AES-256-GCM
# * PFS Key Group: 14
# * Local Network: 10.0.0.0/24
# * Remote Network: 192.168.1.0/24
# * Lifetime: 3600 seconds (1 hour)

# Verifikasi IPsec:
# Status > IPsec
# Jika Connected - koneksi aktif
# Jika down - cek log: Status > System Logs > IPsec

# Test koneksi antar site:
ping 192.168.1.10   # Dari jaringan 10.0.0.x ke 192.168.1.x
# Jika reply → IPsec berfungsi

# Navigasi: VPN > WireGuard
# WireGuard lebih baru, lebih cepat, dan lebih simple dari OpenVPN/IPsec

# Buat instance:
# * Listen Port: 51820
# * Private Key: (auto-generate)
# * Public Key: (auto dari private key)
# * Tunnel Address: 10.0.9.1/24

# Tambah Peer (client):
# * Public Key: (public key client)
# * Allowed IPs: 10.0.9.2/32, 10.0.0.0/24
# * Endpoint: <client-public-IP>:51820

# Aturan firewall:
# Firewall > Rules > WAN
# Pass proto UDP from any to WAN-IP port 51820

# Konfigurasi client (Linux):
cat /etc/wireguard/wg0.conf
# [Interface]
# PrivateKey = <client-private-key>
# Address = 10.0.9.2/24
# DNS = 1.1.1.1
#
# [Peer]
# PublicKey = <server-public-key>
# Endpoint = 203.0.113.10:51820
# AllowedIPs = 0.0.0.0/0  # Full tunnel (semua traffic via VPN)

# Start client:
wg-quick up wg0

# Cek status:
wg show
# interface: wg0
#   public key: <...>
#   private key: (hidden)
#   listening port: 51821
# peer: <server-public-key>
#   endpoint: 203.0.113.10:51820
#   allowed ips: 0.0.0.0/0
#   transfer: 1.5 MiB received, 3.2 MiB sent

# Navigasi: Firewall > Traffic Shaper
# Dua metode:
# 1. Wizard (recommended) - panduan step-by-step
# 2. Manual (advanced user)

# Wizard menghasilkan:
# * Limit bandwidth upload/download untuk tiap interface
# * Queue prioritas untuk traffic penting
# * Queue terendah untuk P2P/download

# Contoh queue:
# 1. Priority Queue (High): VoIP, SSH, DNS
#    - Bandwidth guarantee: 1 Mbps
#    - Max: 10 Mbps
# 2. Normal Queue: Web, Email, API
#    - Bandwidth guarantee: 10 Mbps
#    - Max: 50 Mbps
# 3. Bulk Queue: P2P, Large Download, Backup
#    - Bandwidth guarantee: 1 Mbps
#    - Max: 20 Mbps (sisa bandwidth)

# Aturan Traffic Shaper:
# Firewall > Traffic Shaper > Rules
# Match traffic HTTP/HTTPS → Normal Queue
# Match traffic SSH, DNS, VoIP → Priority Queue
# Match traffic torrent, steam → Bulk Queue

# Layer 7 traffic shaping via limiters:
# Firewall > Traffic Shaper > Limiters

# Buat limiter:
# * Name: USER_10MB
# * Bandwidth: 10 Mbps
# * Mask: Source (per IP)
# * Queue: default

# Terapkan limiter ke aturan:
# Firewall > Rules > LAN
# Edit rule "Allow LAN to Any"
# Advanced Options > Limiters
# Out Limiter: USER_10MB

# Navigasi: Services > Captive Portal

# Konfigurasi zone:
# * Interface: OPT1 (guest WiFi interface)
# * Idle Timeout: 30 minutes
# * Hard Timeout: 12 hours
# * Pre-auth Timeout: 5 minutes (bypass untuk akses awal)
# * Maximum concurrent connections: 10 per IP
# * Authentication: Local user, RADIUS, atau voucher

# Contoh halaman login HTML:
# /usr/local/captiveportal/htdocs/login.html
# <form method="post" action="/index.php?zone=captive">
#   <input type="text" name="auth_user" placeholder="Username">
#   <input type="password" name="auth_pass" placeholder="Password">
#   <button type="submit">Login</button>
# </form>

# Allowed IP addresses (bypass captive portal):
# * DNS servers (1.1.1.1, 8.8.8.8)
# * NTP servers
# * Your own branding/landing page

# Voucher-based access (untuk hotel/kafe):
# Services > Captive Portal > Vouchers
# Generate 50 voucher kode (8 digit):
# MASA-TMGG-1234, CBUD-HELO-5678, ...
# Masa berlaku: 24 jam, 7 hari, 30 hari

# Navigasi: Services > Suricata
# Install: System > Package Manager > Suricata

# Konfigurasi Global:
# * Interface: WAN (monitor inbound threats)
# * Rulesets: ET Open (Emerging Threats), SSLBL, Feodo
# * IPS Mode: ON (aktif block) - OFF untuk IDS only
# * Promiscuous Mode: ON

# Auto-update ruleset:
# Services > Suricata > Update Rules
# Update otomatis via cron: 0 */6 * * * (setiap 6 jam)

# Contoh aturan yang aktif:
# alert http \$HOME_NET any -> \$EXTERNAL_NET any
#   (msg:"ET MALWARE Known C2 Pattern";
#    content:"|00 00 00 00|"; sid:2000000; rev:1;)

# Cek alert:
# Services > Suricata > Alerts
# Filter: protocol:TCP, severity:1-2

# Log lokasi:
# /var/log/suricata/
# ├── alert.json      # Alert dalam format JSON
# ├── fast.log        # Alert ringkas
# ├── stats.log       # Statistik traffic/performance
# └── eve.json        # Semua event (enriched JSON)

# Scenaro: port scan terdeteksi dari IP eksternal

# Suricata alert di fast.log:
# 07/22/2026-10:00:05.123456 [**] [1:2013028:3] ET SCAN Potential SSH Scan [**]
#   [Classification: Attempted Information Leak] [Priority: 2]
#   {TCP} 185.220.101.XX:54321 -> 203.0.113.10:22

# Jika IPS mode ON, koneksi otomatis di-drop:
# Alert: "DROP" bukan "ALERT"
# [Drop] [**] [1:2013028:3] ET SCAN Potential SSH Scan
# Sumber IP otomatis diblokir selama durasi rule

# Lihat block di pfSense firewall log:
# Status > System Logs > Firewall
# Block 185.220.101.XX port 22 (suricata block)

# Navigasi: Services > DNS Resolver

# Konfigurasi Dasar:
# * Enable: ON
# * Listening Port: 53
# * Network Interfaces: LAN, Localhost
# * DNSSEC: ON (validasi signature DNS)
# * DNS Query Forwarding: OFF (recursive langsung ke root)

# DNS over TLS (enkripsi query DNS):
# * DNS Forwarders > DNS over TLS
# * Cloudflare: 1.1.1.1@853#cloudflare-dns.com
# * Quad9: 9.9.9.9@853#dns.quad9.net

# Custom DNS entries (override/PiHole-like):
# Services > DNS Resolver > Advanced > Custom Options
# # Blokir domain berbahaya
# local-zone: "ads.example.com" redirect
# local-data: "ads.example.com A 0.0.0.0"
# local-zone: "tracker.example.net" redirect
# local-data: "tracker.example.net A 0.0.0.0"

# # Local DNS (akses server via hostname)
# local-data: "nas.local.lab A 10.0.0.50"
# local-data: "wiki.local.lab A 10.0.0.51"

# Verifikasi DNS:
dig @10.0.0.1 google.com
# ;; Query time: 5 msec
# ;; SERVER: 10.0.0.1#53(10.0.0.1)

# Navigasi: Services > DHCP Server

# Konfigurasi LAN interface:
# * Enable: ON
# * Range: 10.0.0.100 - 10.0.0.200
# * Subnet Mask: 255.255.255.0 (/24)
# * Gateway: 10.0.0.1 (IP pfSense LAN)
# * DNS: 10.0.0.1 (Unbound lokal) atau 1.1.1.1
# * Domain Name: lab.local
# * Default Lease: 86400 (24 jam)
# * Max Lease: 172800 (48 jam)

# Static DHCP Mapping:
# * IP: 10.0.0.10
# * MAC: aa:bb:cc:dd:ee:11
# * Hostname: web-server
# * Descr: Main web server

# Advanced Options:
# * Dynamic DNS: auto-update hostname ke Unbound
# * TFTP Server: 10.0.0.1 (untuk PXE boot)
# * NTP Server: 0.id.pool.ntp.org
# * Email Server: 192.168.1.10

# Verifikasi DHCP leases:
# Status > DHCP Leases
# Lihat IP yang aktif, MAC address, lease time

# Jalankan dari CLI pfSense (SSH):
pftop

# Output:
# view: 0 -> default
# PR    DIR   SRC                DEST                STATE       AGE    EXP
# tcp   Out   WAN:54321         8.8.8.8:53          ESTAB:1:1   10s    86000
# tcp   In    10.0.0.10:443     192.168.1.5:34567   ESTAB:1:1   5m     79000
# tcp   In    10.0.0.1:22       10.0.0.100:54321    ESTAB:1:1   2h     54321

# Shortcuts:
# s: sort by field (age/bytes/destination)
# r: reverse sort
# i: toggle idle states
# b: toggle bandwidth display
# q: quit

# Mode bandwidth (lihat traffic rate per koneksi):
pftop -w
# Output:
# BW     SRC                DEST                STATE      RATE
# 1.2M   10.0.0.10:443     10.0.0.100:56789    ESTAB      600KB/s
# 512K   10.0.0.50:3389    10.0.0.100:54321    ESTAB      256KB/s

# Lihat hanya state tertentu:
pftop -s port 22    # Hanya SSH
pftop -s proto tcp  # Hanya TCP

# Install: System > Package Manager > ntopng

# Akses web interface:
# http://pfsense-ip:3000

# Informasi yang ditampilkan:
# - Top talkers (IP dengan traffic terbanyak)
# - Application layer identification (HTTP, DNS, SSH, dll.)
# - Traffic matrix (siapa ngobrol dengan siapa)
# - Host analysis (OS fingerprint, services)
# - Protocol distribution (pie chart)
# - Historical graphs (hourly, daily, weekly)

# Cek dari CLI:
curl http://localhost:3000/api/v1/host/data

# Navigasi: Status > Monitoring
# Tampilan:
# - In/Out traffic per interface (WAN, LAN, OPT)
# - Last: 5 min, 15 min, 30 min, 1 hour, 2 hour, 6 hour
# - View: RRD Graph (real-time), Bar Chart, Line Chart

# Data tersimpan di:
ls -la /var/db/rrd/
# wan.rrd, lan.rrd, cpu.rrd, memory.rrd, ...

# Export data RRD ke CSV:
rrdtool fetch /var/db/rrd/wan.rrd AVERAGE -r 300 -s -1h > /tmp/wan-traffic.csv

# Lihat data terbaru:
rrdtool lastupdate /var/db/rrd/wan.rrd

# Arsitektur CARP:
#                    Internet
#                        |
#                  Virtual IP (VIP)
#                        |
#            +-----------+-----------+
#            |                       |
#       pfSense-1               pfSense-2
#        (MASTER)               (BACKUP)
#            |                       |
#            +-----------+-----------+
#                        |
#                    LAN Switch
#                        |
#                  LAN Clients

# Konfigurasi CARP:
# Firewall > Virtual IP > Add > CARP IP

# Interface: WAN
# Address: 203.0.113.10/32
# VHID Group: 1 (sama di kedua node)
# Password: carp-secret
# Advertising Frequency: 1 (Master)
# Preempt: Yes

# Interface: LAN
# Address: 10.0.0.1/32
# VHID Group: 2
# Password: carp-secret
# Advertising Frequency: 1
# Preempt: Yes

# System > High Availability Sync

# Status Synchronization:
# * Enable: ON
# * Synchronize Config to IP: 10.0.0.2 (peer LAN IP)
# * Remote System Username: admin
# * Remote System Password: (password peer)

# Fitur yang disinkronisasi:
# - Firewall rules
# - NAT rules
# - VPN config
# - DHCP config
# - DNS resolver config
# - Captive portal
# - Package settings

# Test failover:
# 1. Matikan pfSense-1 (master)
# 2. Dalam 1-2 detik, pfSense-2 menjadi master
# 3. Ping ke VIP (10.0.0.1) - harus tetap reply
# 4. Koneksi VPN tetap aktif

# Diagnostics > Backup & Restore

# Backup Area:
# [x] Config (termasuk semua aturan dan konfigurasi)
# [x] RRD Data
# [x] Captive Portal Data
# [ ] Include SSH keys

# Download: pfsense-config-20260722.xml
# Format: XML - bisa diedit teks biasa
# Ukuran: biasanya 50-200 KB

# Enkripsi backup:
# Check "Encrypt this configuration file"
# Password: <master-password>
# Output: pfsense-config-20260722.enc

# Backup dari terminal (via SSH):
# Backup konfigurasi:
ssh [email protected] "/usr/local/sbin/pfSense-config-backup.sh" > pfSense-backup-\$(date +%Y%m%d).xml

# Atau via config file langsung:
scp [email protected]:/cf/conf/config.xml .
# config.xml adalah file konfigurasi utama pfSense

# Backup konfigurasi + enkripsi GPG:
ssh [email protected] "/usr/local/sbin/pfSense-config-backup.sh" | gpg --encrypt --recipient [email protected] > pfSense-\$(date +%Y%m%d).xml.gpg

# Metode 1 - Via GUI:
# Diagnostics > Backup & Restore > Restore
# Pilih file XML, klik Restore
# pfSense akan restart dengan konfigurasi baru

# Metode 2 - Via CLI (jika web interface tidak bisa diakses):
# Boot ke Single User Mode atau console
# Gunakan shell:

cp /cf/conf/config.xml /cf/conf/config.xml.bak
cp /tmp/pfSense-config.xml /cf/conf/config.xml
reboot

# Buat skrip backup otomatis di server backup:
#!/bin/bash
# /opt/scripts/backup-pfsense.sh

BACKUP_DIR="/opt/pfsense-backups"
PFSENSE_IP="10.0.0.1"
DATE=\$(date +%Y-%m-%d-%H%M)
RETENTION=30  # Hapus backup lebih dari 30 hari

# Backup config
scp admin@\$PFSENSE_IP:/cf/conf/config.xml \$BACKUP_DIR/pfsense-\$DATE.xml

# Enkripsi
gpg --encrypt --recipient [email protected] \
  \$BACKUP_DIR/pfsense-\$DATE.xml && \
  rm \$BACKUP_DIR/pfsense-\$DATE.xml

# Hapus backup lama
find \$BACKUP_DIR -type f -name "*.xml.gpg" -mtime +\$RETENTION -delete

# Cron job (setiap hari jam 02:00):
# 0 2 * * * /opt/scripts/backup-pfsense.sh

# 1. Ubah default port SSH (jangan 22):
# System > Advanced > SSH Port: 2222

# 2. Disable admin GUI via WAN:
# System > Advanced > Admin Access
# [ ] WebGUI from WAN (uncheck)
# [ ] SSH from WAN (uncheck)

# 3. Gunakan HTTPS-only untuk WebGUI:
# Protocol: HTTPS (rekomendasi)
# SSL Certificate: Let's Encrypt auto-renew

# 4. Anti-lockout rule:
# System > Advanced > Firewall > Anti-Lockout: ON
# (Pastikan aturan ini ada, atau Anda bisa terkunci dari GUI)

# 5. Rate limiting SSH:
# Firewall > Rules > LAN
# Advanced > Max Established: 3 (per IP)
# Advanced > Max Src Ports: 100

# 6. Block private/bogon networks di WAN:
# Firewall > Advanced > Bogon Networks
# [x] Automatically update bogon networks
# [x] Block private networks from WAN

# 7. Disable unnecessary services:
# Services > SNMP: OFF
# Services > UPnP: OFF
# Services > Dynamic DNS: OFF (jika tidak perlu)

# 8. Password policy:
# System > User Manager > Settings
# Min length: 12
# Require strong password: Yes

# 9. Remote syslog ke server SIEM (misal Wazuh):
# Status > System Logs > Settings
# Enable Remote Logging: ON
# Remote log server: 10.0.0.15 (Wazuh indexer)
# Remote Syslog Contents: Everything

# Topologi:
# Internet → pfSense → Switch → 50 Client
#                         → DMZ (Web Server, Mail Server)

# Konfigurasi Interface:
# WAN: DHCP dari ISP
# LAN: 10.0.0.1/24 (kantor)
# OPT1: 172.16.0.1/24 (DMZ)

# Firewall Rules:
# WAN: Block all (default)
# LAN: Allow any to any
# DMZ Rules:
#   1. Allow HTTP/HTTPS from any to Web Server (172.16.0.10)
#   2. Allow SMTP/IMAP from any to Mail Server (172.16.0.11)
#   3. Allow SSH from LAN to DMZ servers

# NAT:
# Port Forward 443 → 172.16.0.10:443
# Port Forward 25, 993 → 172.16.0.11
# Outbound NAT: Automatic (all LAN)

# QoS:
# VoIP priority queue (UDP 5060, RTP 16384-32768)
# Download: 20 Mbps per user (limiter)

# Kantor Pusat (Jakarta): 10.0.0.0/24
# Kantor Cabang (Surabaya): 192.168.1.0/24

# IPsec VPN - Jakarta (HQ):
# WAN: 203.0.113.10
# Phase 1: AES-256-SHA256-DH14
# Remote Gateway: 203.0.113.20 (Surabaya)
# Phase 2: 10.0.0.0/24 ↔ 192.168.1.0/24

# IPsec VPN - Surabaya:
# WAN: 203.0.113.20
# Phase 1: AES-256-SHA256-DH14
# Remote Gateway: 203.0.113.10 (Jakarta)
# Phase 2: 192.168.1.0/24 ↔ 10.0.0.0/24

# Routing:
# Jakarta: static route 192.168.1.0/24 → IPsec tunnel
# Surabaya: static route 10.0.0.0/24 → IPsec tunnel

# Test:
# Dari kantor Surabaya:
ping 10.0.0.10  # Web server di Jakarta
# Dari kantor Jakarta:
ping 192.168.1.10  # Server di Surabaya

# Skenario: internet 50 Mbps untuk 100 user

# Queue Configuration:
# 1. Critical (10% guaranteed, max 20%):
#    - VoIP, Video Conference
#    - DNS, NTP
#    - SSH to servers
#
# 2. Business (40% guaranteed, max 60%):
#    - Email (SMTP, IMAP)
#    - Internal CRM/ERP traffic
#    - API calls
#
# 3. Normal (30% guaranteed, max 40%):
#    - Web browsing (HTTP/HTTPS)
#    - Software updates (work hours: limited)
#
# 4. Bulk (5% guaranteed, max 20%):
#    - YouTube, Streaming
#    - Large file downloads
#    - P2P (blocked entirely)

# Limiters per-user:
# Normal saat jam kerja (08:00-17:00): 5 Mbps
# Normal di luar jam: 20 Mbps
# Streaming: 2 Mbps per user

# Skenario: kafe dengan WiFi gratis

# Konfigurasi:
# Interface: OPT1 (guest WiFi) - 192.168.10.1/24
# DHCP: 192.168.10.100-200
# Captive Portal enabled on OPT1

# Autentikasi: Voucher (tidak perlu akun)
# Voucher valid: 2 jam, 1 hari, 7 hari

# Harga:
# 2 jam: Gratis (generate otomatis dengan promo)
# 1 hari: Rp 15.000
# 7 hari: Rp 50.000

# Bandwidth limit per guest:
# Limiter: 5 Mbps download, 2 Mbps upload
# Idle timeout: 15 menit
# Hard timeout: sesuai voucher

# Bypass (allow without login):
# DNS: 1.1.1.1, 8.8.8.8
# NTP: pool.ntp.org
# POS system kafe: 192.168.0.10

# Skenario: deteksi malware/scan di jaringan kantor

# Suricata di interface WAN:
# Ruleset: ET Open, SSLBL, Emerging Threats

# Alert yang di-filter:
# [Level 1] C2 Beaconing → admin notification
# [Level 2] Port Scan → log saja
# [Level 3] Malware Signature → block + notification

# Output ke Elasticsearch (via syslog):
# Services > Suricata > Global Settings
# Enable EVE Output: JSON format
# Syslog output: 10.0.0.50:5514 (Logstash)

# Di Wazuh dashboard (sebagai SIEM):
# Filter: suricata.alert.severity: 1 AND suricata.alert.action: blocked
# Buat dashboard khusus Suricata alerts