Solutii de securitate free pe Linux si OPNsense

Un inventar practic de solutii free (si accesibile) pe care le configuram pe Linux sau OPNsense ca sa acoperi detectie, prevenire, threat intelligence si vizibilitate. Nu doar nume — si ce face fiecare, plus cum se integreaza feed-urile in firewall.

IDS / IPS — detectie si blocare intruziuni

Suricata — IDS/IPS pe semnaturi, inline; integrat nativ in OPNsense (os-suricata), reguli ET Open + Abuse.ch
Snort 3 — IDS/IPS clasic cu reguli Talos; bun ca al doilea motor de cross-validare
Zeek (Bro) — analiza de trafic si metadate de retea (nu doar semnaturi) — vizibilitate profunda, ideal pt threat hunting

SIEM / detectie pe host + loguri

Wazuh — SIEM + HIDS: colectare loguri, integritate fisiere (FIM), detectie rootkit, conformitate CIS/PCI, agenti pe Windows/Linux
OSSEC — HIDS clasic (baza Wazuh): integritate, corelare, alertare
Grafana + Loki — agregare si vizualizare loguri centralizata, dashboards + alerting

IPS reputational / colaborativ

CrowdSec — IPS colaborativ: scenarii comportamentale + reputatie globala (IP-uri raportate de intreaga retea); bouncer nftables/nginx; plugin OPNsense os-crowdsec
Fail2ban — ban pe baza de loguri (SSH, nginx) — simplu, local, matur; bun pt reguli punctuale

Threat intelligence / feeds

Q-Feeds — agregator european (NL) de threat intelligence — combina zeci de surse in blocklists de IP-uri si domenii malitioase. Se integreaza direct in OPNsense / pfSense / FortiGate ca URL Table alias (auto-refresh) — pui URL-ul, faci o regula de block si gata. Are feed comunitar + planuri accesibile pt SMB. Cel mai simplu mod de a aduce threat intel intr-un firewall fara SOC propriu.
Team Cymru — bogon lists, UTRS (blackhole colaborativ prin BGP), servicii comunitare de reputatie IP/ASN
Abuse.ch — Feodo (C2 botnet), URLhaus (URL-uri malware), SSLBL (certificate rele), ThreatFox (IOC) — se pun direct in Suricata sau ca alias de firewall
Spamhaus DROP / EDROP — liste de retele controlate de atacatori — integrabile ca URL table in firewall
FireHOL / blocklist.de — liste agregate de IP-uri abuzive (SSH brute-force, scanare), gata de importat, pe niveluri de agresivitate
MISP — platforma de partajare threat intelligence (IOC) — sursa care alimenteaza reguli, feed-uri si blocklists intre echipe

Cum integrezi feed-urile in OPNsense (practic)

Cel mai practic mod de a folosi threat intelligence: aduci feed-urile (Q-Feeds, Spamhaus, FireHOL, Abuse.ch) ca alias de firewall care se reimprospateaza automat, apoi o regula de block. Fara SOC, fara scripturi complicate.

# OPNsense: Firewall -> Aliases -> Add
#   Type: URL Table (IPs)   Refresh frequency: 1 day
#   Content: URL-ul feed-ului, de ex:
#     Q-Feeds:     URL dedicat per cont (IP-uri + domenii malitioase)
#     Spamhaus:    https://www.spamhaus.org/drop/drop.txt
#     FireHOL:     https://iplists.firehol.org/files/firehol_level1.netset
# apoi Firewall -> Rules -> Floating -> action Block, Source = aliasul

# echivalent pe Linux pur (nftables + cron care reincarca setul zilnic):
curl -s https://www.spamhaus.org/drop/drop.txt \
  | grep -oE '^[0-9.]+/[0-9]+' \
  | while read cidr; do sudo nft add element inet filter blocklist "{ $cidr }"; done

Firewall / filtrare retea

nftables — firewall modern pe Linux: seturi, rate-limit, NAT, logging
OPNsense + GeoIP2 — blocare pe tara, aliasuri de IP, integrare feeds (Q-Feeds, Spamhaus)
pfBlockerNG (pfSense) — GeoIP + DNSBL + feeds de reputatie intr-un singur plugin

VPN / acces securizat

WireGuard — VPN modern, rapid, simplu; nativ in kernel si OPNsense; site-to-site sau road-warrior
OpenVPN — matur, flexibil, TLS; bun pt compatibilitate
IPsec / strongSwan — site-to-site standard, interoperabil cu Fortinet/Cisco

Scanare vulnerabilitati / audit

OpenVAS / Greenbone — scanner de vulnerabilitati de retea, rapoarte periodice
Lynis — audit de hardening pe host Linux (scor CIS-like)
Trivy — scanare imagini Docker / IaC pt CVE
ClamAV — antivirus open-source (mail, fisiere; plugin OPNsense)
AIDE / auditd — integritate fisiere + audit de sistem la nivel kernel

Vizibilitate / monitoring

ntopng — analiza trafic in timp real, DPI, fluxuri, top talkers
Zabbix / Prometheus — monitoring infrastructura + alerting
Netdata — metrici in timp real per host, zero-config
Suricata EVE + Grafana — dashboards din alertele Suricata (eve.json)

Incident response

TheHive + Cortex — case management pt incidente + analizoare automate (enrichment IOC)
MISP — corelare IOC intre incidente si echipe

Exemplu: stack tipic SMB (instalare rapida)

Un punct de plecare concret pentru un stack minim viabil:

# OPNsense (din shell): IDS/IPS + IPS colaborativ
pkg install os-suricata os-crowdsec

# host Linux: CrowdSec + feed reputatie in nftables
curl -s https://install.crowdsec.net | sudo sh && sudo apt -y install crowdsec
# + adaugi un feed (Q-Feeds/Spamhaus) ca alias URL table in OPNsense (vezi mai sus)

Concluzie

Nu ai nevoie de toate — alegi in functie de risc si echipa. Stack tipic SMB: Suricata + CrowdSec pe OPNsense, un feed Q-Feeds/Abuse.ch ca alias de firewall, Wazuh pe hosturi, WireGuard pt acces. Il proiectam, configuram si monitorizam pentru tine.

Solutii de securitate free pe Linux si OPNsense — catalog