Editing PF Sense Firewall Implementation at GIPL (section)

== Select which types of rules will protect the network ==
Click the '''Categories''' tab for the new interface

Check [https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=GPLv2_community.rules Snort GPLv2 Community Rules (VRT certified)] Box .

And Manual Rules :-

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-botcc.rules emerging-botcc.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_blacklist.rules snort_blacklist.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.so.rules snort_exploit-kit.so.rules] 

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_ddos.rules snort_ddos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_dos.rules snort_dos.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_exploit-kit.rules snort_exploit-kit.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-malware.rules emerging-malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-mobile_malware.rules emerging-mobile_malware.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-tor.rules emerging-tor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=emerging-trojan.rules emerging-trojan.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_malware-backdoor.rules snort_malware-backdoor.rules]

[https://203.77.200.91:8080/snort/snort_rules.php?id=0&openruleset=snort_virus.rules snort_virus.rules]


[[Image:Gpil-024.jpg]]

Click SAVE when finished to save the selection and build the rules 

After that restart the service 

[[Image:Gpil-025.jpg]]

'''Managing Pass lists:-'''

'''Pass Lists are lists of IP addresses that Snort should never block. These may be created and managed on the Pass Lists tab. When an IP address is listed on a Pass List, Snort will never insert a block on that address even when malicious traffic is detected.'''


'''To create a new Pass List, click "+". To edit an existing Pass List, click the "e". To delete a Pass List, click "x". Note that a Pass List may not be deleted if it is currently assigned to one or more Snort interfaces.'''


We have added GIPL IP’s in Pass list . i.e''' <u>203.77.192.0/20'''</u>


[[Image:Gpil-026.jpg]]