An inventory of free, mature solutions you can configure on Linux or OPNsense to cover detection, prevention and visibility. Grouped by category, with what each does.
IDS / IPS — intrusion detection and blocking
- Suricata — signature IDS/IPS, inline; natively integrated in OPNsense (os-suricata)
- Snort 3 — classic IDS/IPS, Talos rules; good as a second engine
- Zeek (Bro) — network traffic and metadata analysis, not just signatures — deep visibility
SIEM / host + log detection
- Wazuh — SIEM + HIDS: log collection, FIM, anomaly detection, compliance (CIS)
- OSSEC — classic HIDS (Wazuh's base): file integrity, rootkit, correlation
- Grafana + Loki — centralized log aggregation and visualization, alerting
Reputational / collaborative IPS
- CrowdSec — collaborative IPS: behavioral scenarios + global reputation; nftables/nginx bouncer; OPNsense os-crowdsec plugin
- Fail2ban — log-based banning (SSH, nginx) — simple, local, mature
Free threat intelligence / feeds
- Team Cymru — bogon lists, UTRS (collaborative blackhole), community reputation services
- Abuse.ch — Feodo (C2), URLhaus (malware URLs), SSLBL (bad certs) feeds — straight into Suricata/firewall
- Spamhaus DROP/EDROP — hostile network lists, firewall-integrable
- FireHOL / blocklist.de — aggregated abusive-IP lists, ready to import
- MISP — threat intelligence sharing platform (IOCs) — a source for rules/blocklists
Firewall / network filtering
- nftables — modern Linux firewall: sets, rate-limit, NAT
- OPNsense + GeoIP2 — country blocking, IP aliases, feed integration
- pfBlockerNG (pfSense) — GeoIP + DNSBL + reputation feeds in one plugin
VPN / secure access
- WireGuard — modern, fast, simple VPN; native in kernel and OPNsense
- OpenVPN — mature, flexible, TLS; good for compatibility
- IPsec/strongSwan — standard site-to-site, interoperable with Fortinet/Cisco
Vulnerability scanning / audit
- OpenVAS / Greenbone — network vulnerability scanner, reports
- Lynis — host hardening audit for Linux (CIS-like)
- Trivy — scan Docker images / IaC for CVEs
- ClamAV — open-source antivirus (mail, files; OPNsense plugin)
- AIDE / auditd — file integrity + kernel-level system auditing
Visibility / monitoring
- ntopng — real-time traffic analysis, DPI, flows
- Zabbix / Prometheus — infrastructure monitoring + alerting
- Netdata — real-time per-host metrics, zero-config
Incident response
- TheHive + Cortex — incident case management + automated analyzers
- MISP — IOC correlation across incidents and teams
Conclusion
You do not need all of them — pick based on risk and team. A typical SMB stack: Suricata + CrowdSec on OPNsense, Wazuh on hosts, Abuse.ch/Cymru feeds, WireGuard for access. We design and configure it for you.