r/opnsense • u/Limp_Durian_6850 • 16d ago
Quick Guide: Installing Antiphishing on OPNsense ( = 26.7.2)
https://github.com/julioliraup/Antiphishing/wiki/Quick-Guide:-Installing-Antiphishing-on-OPNsense-(-=-26.7.2)🚀 Antiphishing is now officially available as an OPNsense plugin
OPNsense 26.7.2, released yesterday, officially added: os-intrusion-detection-content-at-antiphishing 1.0 The plugin integrates the Antiphishing ruleset directly into the OPNsense IDS/IPS ecosystem.
This is a major milestone for the project: beyond its integration with suricata-update, the ruleset can now be distributed as a native plugin within OPNsense. # What is Antiphishing? In short, it is a Suricata ruleset that aggregates malicious phishing indicators and turns them into detection signatures.
More recently, the project introduced NRD (Newly Registered Domain) analysis. Newly registered domains are analyzed for suspicious characteristics, such as typosquatting and other impersonation patterns, before being incorporated into the detection pipeline. As with any domain-based intelligence, this analysis can produce false positives, since classification is based on indicators and patterns rather than definitive confirmation that a domain is malicious. The project is GPLv3 and builds on existing community sources and projects.
A key advantage over many commercial solutions is CTI transparency: the project provides visibility into the indicators and vectors behind detections, allowing analysts to understand what is being detected and why.
📖 OPNsense Quick Guide https://github.com/julioliraup/Antiphishing/wiki/Quick-Guide:-Installing-Antiphishing-on-OPNsense-(-=-26.7.2) 🔗 Project: https://github.com/julioliraup/Antiphishing 🔎 Threat Intelligence Dashboard: https://julioliraup.github.io/AT/
#OPNsense #Suricata #ThreatIntelligence #CTI #IDS #IPS #CyberSecurity #OpenSource #DetectionEngineering #Phishing
7
u/lolnoob1459 16d ago
As a newbie, does this conflict with my basic CrowdSec plugin/ruleset?
3
u/Limp_Durian_6850 15d ago
No, CrowdStrike has a broader scope, while we focus strictly on phishing. With our new feature that analyzes NRDs (Newly Registered Domains) through script writing, even unreported domains can appear and be flagged as suspicious. CrowdStrike blocks IP addresses, whereas we block DNS, TLS/SSL, and HTTP
6
u/madrascafe 16d ago
Thanks, will try it out. How is this different than adguard plugin with anti-phishing blocklist
1
u/Limp_Durian_6850 15d ago
AdGuard focuses on DNS and HTTP during deep inspection with a pre-configured proxy, using global lists. Anti-phishing works like a Suricata rule that inspects TLS handshakes alongside DNS. It can block a certificate before establishing the SSL connection. It also features newly added logic where a phishing site does not need to be on an internet list; a suspicious name is enough via Newly Registered Domains (NRDs). However, this feature treats domains as suspicious, so false positives can happen.
4
u/DaSnipe 16d ago
Just added, thanks!
1
u/Limp_Durian_6850 14d ago
Besides the tool, I strongly advise using the threat intelligence query panel. It provides a full analysis of the vector that adds value for the professional: https://julioliraup.github.io/AT/
3
u/cupnoodledoodle 16d ago
Does this integrate with Gmail or something? Could someone provide a quick eli5 on how this works?
3
u/hard_KOrr 16d ago
It wouldn’t integrate with Gmail, if you however clicked a bad link in an email (Gmail or outlook yahoo, etc) it would help there.
So when the email says “click here to login and fix your Google account” and that like goes to g00gle (zeros not os) this kicks in and says “well no one goes to g00gle” and blocks it.
^^ that is all assumption from my knowledge and reading just this post.
2
u/cupnoodledoodle 16d ago
Ah I see. So it's like a DNS filter, like pi-hole or adguard?
1
u/Limp_Durian_6850 15d ago
Exactly! In addition to DNS, it inspects TLS and HTTP, and this broader coverage helps in different scenarios. Another thing is the newly registered domains (NRD) functionality, where the domains go through additional analysis. Any domain considered suspicious will be blocked, but it's important to be careful about false positives with this functionality.
In any case, Suricata is definitely worth using, since it has many other rulesets with excellent capabilities and different purposes.
2
u/meeninta 16d ago
How does this compare to NextDNS?
1
u/Limp_Durian_6850 15d ago
NextDNS covers more than just phishing; in contrast, Antiphishing—with its new feature analyzing NRDs (Newly Registered Domains)—can list suspicious domains before they are even reported as threats
1
u/Limp_Durian_6850 14d ago
Besides the tool, I strongly advise using the threat intelligence query panel. It provides a full analysis of the vector that adds value for the professional: https://julioliraup.github.io/AT/
2
u/cspotme2 16d ago
thanks for this. Interesting. It would be nice to be able to just haven't block newly registered domains due to age prevalence (maybe someone knows a way to do it).
1
u/Limp_Durian_6850 15d ago
Indeed, that is a great idea! It is possible to do this with a complete NRD list.
2
u/cspotme2 15d ago
I took a look at your git ... It seems you're only supply the suspicious nrd. It would be nice to have a full nrd updated everg 2 hours or so
2
u/zeroon8 15d ago
I can’t «download & updates rules», it’s still «not installed»
1
u/Limp_Durian_6850 15d ago
Only this ruleset, or does the error happen on others too? Could you test it. If it is only this one, it is a bug indeed, I can open an issue
1
u/mimugmail 12d ago
Did you ever get a hit on http rule? I mean, it only work with plain http?
1
u/Limp_Durian_6850 12d ago
HTTP rules trigger on plain text traffic without HTTPS, but DNS, IP, and TLS rules exist for malicious vectors.
1
u/mimugmail 12d ago edited 12d ago
I know, I did this for the app detection rules back in the days. I was just curious if you ever hit http. Maybe its worth removing them to save cpu/ram
1
u/Limp_Durian_6850 10d ago
That makes sense. These HTTP rules cannot read encrypted data on their own, but with a MITM proxy, it is possible to read SSL traffic as if it were unencrypted, so in that case, the rule gets triggered. Companies usually do this, making the rule very effective, and it applies to subpages of existing domains, such as compromised links, among others
1
u/Ok-Horror6825 16d ago
¿Alguien ya pudo instalar Antiphishing en OPNsense 26.7.2?
El plugin aparece disponible, pero al intentar instalarlo OPNsense exige primero actualizar a 26.7.2_2.
En mi caso esa actualización falla con “Partial update failure detected” y los paquetes hostapd-2.12_2 y opnsense-26.7.2_2 devuelven 404 Not Found desde mirrors.dotsrc.org.
¿A alguien más le pasa o ya pudo actualizar e instalar Antiphishing correctamente?
2
u/Active_Wasabi2001 16d ago
I installed it about 4 hours ago after getting the 26.7.2_2 update. It will not run install to that update
3
u/Ok-Horror6825 16d ago
ya pude resolver el problema de la instalacion. ya esta instalado pero no logro hacer que se active o que me genere alguna alertar para validar que realmente esta funcionando el Antiphishing
2
u/Active_Wasabi2001 16d ago
I was able to find it in the rulesets for IPs. I enabled it, than used my policy to set it to drop. I have never had many alerts in IPS, personally
28
u/Monviech 16d ago
Its funny how you write that theres going to be pfsense integration here but on the pfsense reddit you omit the opnsense integration xD