Network Traffic Monitoring for Intrusion Detection

[ericnix]

I'm currently using a Ubiquiti EdgeRouter Pro and UniFi switch on my network. I have an OpenVPN set up as well as remote access to three cameras.

I would like to monitor my network for any network intrusion from outside.

What would be the best option to do this? I've looked at pfSense running Snort. I'm not sure if that will do what I want it to do. Basically I would like everything on my network to be mirrored to the device for intrusion detection.

Any recommendations for hardware and ways to set this up?

Thanks!

 

[System Error Message]

you can install snort on the edgerouter. But whether or not you can use it with the edgerouter after installing is another question.

 

[ericnix]

I ended up purchasing an XG-1540 from the pfSense store that is serving as my OpenVPN server and running Snort for intrusion detection.

 

[YeOldeStonecat]

I'm currently using a Ubiquiti EdgeRouter Pro and UniFi switch on my network. I have an OpenVPN set up as well as remote access to three cameras.

I would like to monitor my network for any network intrusion from outside.

What would be the best option to do this? I've looked at pfSense running Snort. I'm not sure if that will do what I want it to do. Basically I would like everything on my network to be mirrored to the device for intrusion detection.

Any recommendations for hardware and ways to set this up?

Thanks!

Just hang on a bit...won't be long, Ubiquiti is looking to introduce an IPS/IDS feature. Will show up in an update.

 

[sfx2000]

I ended up purchasing an XG-1540 from the pfSense store that is serving as my OpenVPN server and running Snort for intrusion detection.

Yikes - that's just a bit of overkill @ $2500USD - it'll certainly do the job though for an good size medium enterprise location...

An alternate would be Netgate's SG-4860 1U $800USD if you need rack support - and this is a fairly capable box - this is also overkill for any home network...

https://www.netgate.com/products/sg-4860-1u.html

The ADI Engineering, Netgate, and pfSense boxes are all the same...

(FWIW - seems that Netgate has closed the pricing loophole - as an example, one could order Netgate 2440 from them at $349, from pfSense at $500...)

Anyways - the ADI/Netgate boxes are very well designed for the purpose at hand...