Firewall integrations

import { Steps, Tabs, TabItem, Aside } from ‘@astrojs/starlight/components’;

Suricatavel integrates directly with perimeter firewalls to enforce network containment and block hostile traffic detected by Suricata sensors or threat intelligence feeds.

---

Supported integrations

Suricatavel supports the following firewall platforms:

• pfSense: Integrates via the pfSense REST API (requires the pfsense-api package).
• OPNsense: Integrates via the native OPNsense REST API (manages firewall Aliases).
• OpenWrt: Integrates via SSH/LuCI and uci / nftables commands.
• MikroTik RouterOS: Integrates via the RouterOS v7+ REST API (manages dynamic address-list entries and filter rules).
• Generic Linux: Integrates via SSH to manage nftables sets or ipset.

---

Connecting a firewall

To connect a new firewall to Suricatavel:

1. Navigate to **Firewalls** in the main navigation menu. 2. Click **New firewall**. 3. Select the **Type** (pfSense, OPNsense, OpenWrt, MikroTik, or Generic Linux). 4. Provide the management parameters: - **Name**: A descriptive label for the device (e.g., `Edge-Mikrotik-01`). - **IP address / Host**: The management address and port. - **Credentials**: API Key/Secret, username/password, or SSH key depending on the adapter. - **Verify SSL**: Toggle certificate validation for HTTPS connections. 5. Click **Create**.

Suricatavel tests the connection immediately to verify credentials and fetch adapter health.

---

Firewall actions

You can enforce containment blocks manually or automatically through Policies and Drongo.

Blocking an IP address

To manually block an address:

1. Navigate to Firewalls > Actions (or click Block IP directly from any Event or Alert).
2. Click New action.
3. Select the target Firewall.
4. Choose the action scope:
   • Source IP: Blocks incoming traffic originating from the malicious address.
   • Destination IP: Blocks outbound traffic targeting the address.
   • Both: Restricts both traffic directions.
5. Configure the TTL (Time to live):
   • Enter a duration in seconds for a temporary ban (e.g., 3600 for 1 hour).
   • Leave empty or set to 0 for a permanent ban.
6. Click Save.

The action is dispatched to the selected firewall immediately, and its status is recorded in Firewalls > History.

Automatic TTL expiration and pruning

Temporary blocks are tracked with their expiration timestamps:

• Firewalls with native TTL support (such as OpenWrt nftables sets or MikroTik timeout address lists) automatically expire entries on the device.
• Suricatavel runs a scheduled maintenance command (php artisan suricatavel:prune-expired-firewall-blocks) to synchronize and clear expired bans from active tables and history.

Unblocking an address

To release an active block:

1. Navigate to Firewalls > Actions.
2. Locate the active rule in the list.
3. Click Unblock.

The rule is removed from the target firewall adapter immediately, and the action history is updated.

---

Domain feeds

Suricatavel publishes an active domain feed endpoint listing malicious domains identified by threat feeds and alerts. This endpoint is designed for firewall packages such as pfBlockerNG on pfSense, OPNsense Aliases, or MikroTik DNS address lists.

Feed endpoint

GET /api/v1/feeds/domains?token=YOUR_PERSONAL_ACCESS_TOKEN

The response returns a plain text list of domains, formatted one entry per line.

Setup on pfSense (pfBlockerNG)

1. In pfSense, open **Firewall > pfBlockerNG > DNSBL > Feeds**. 2. Click **Add**. 3. Enter a list name (e.g., `Suricatavel_Domains`). 4. Set **Source URL** to your Suricatavel feed URL including the token. 5. Set **Action** to `Deny` and configure update frequency. 6. Click **Save** and trigger an update.

Setup on OPNsense

1. In OPNsense, navigate to **Firewall > Aliases**. 2. Click **Add** (`+`). 3. Set **Type** to `URL Table (IPs)` or `URL Table`. 4. Paste the Suricatavel feed URL into the **Content** field. 5. Set the refresh interval (e.g., `1` day or `12` hours). 6. Click **Save** and **Apply changes**.