wf-opnsense

Introduction

This is a sample script demonstrating how you could submit firewall log data from OPNsense to csirtg.io.

Requirements

1. A csirtg.io account
2. An account token; within csirtg.io:
3. Select your username
4. Select "tokens"
5. Select "Generate Token
6. A csirtg.io feed
7. Select (the plus sign)
8. Select Feed
9. Choose a feed name (e.g. port scanners)
10. Choose a feed description (hosts blocked in firewall logs)
11. A router/firewall with OPNsense installed

• Pfsense would likely work but it is untested
• You must have root + shell access

Goals

1. To demonstrate how you interact with csirtg.io without using the SDK
2. To not use any python libraries that were not already installed with OPNsense

Install

1. SSH into the OPNsense router (become root)
2. change to root directory

$ cd /root

1. Download the wf-opnsense.py script using curl

$ curl -O https://raw.githubusercontent.com/giovino/wf-opnsense/master/wf-opnsense.py

1. edit wf-opnsense.py to fill in (CSIRTG_USER, CSIRTG_FEED, CSIRTG_TOKEN)

vi wf-opnsense.py

1. Edit the root crontab

$ crontab -e

Add the following

*/5 * * * * /usr/local/bin/python2.7 /root/wf-opnsense.py 2>&1 | /usr/bin/logger -t csirtg.io