Download free

Block attacks (IPS)

Turn intrusion detection into intrusion prevention, so that attacks and malware traffic are dropped, not only reported.

gate42 watches the LAN for attacks from the first boot, but only reports them (protection). Intrusion prevention (IPS) drops the traffic a rule matches. OPNsense offers it; gate42 recommends its divert mode, where you choose which firewall rules' traffic is inspected. Tested on gate42 2.0: an attack response was dropped and named the device, while normal browsing kept working.

1. Switch Suricata to prevention

  1. Services › Intrusion Detection › Administration › Settings.
  2. Capture mode: Divert (IPS). Keep Enabled ticked.
  3. Apply.

2. Choose the traffic to inspect

In divert mode Suricata sees only the traffic of the firewall rules you divert to it.

  1. Firewall › Rules › LAN, edit Default allow LAN to any rule (or your own rules that let the LAN out).
  2. Show the advanced options; Divert-to: Intrusion Detection.
  3. Save, then Apply. Do the same for the IPv6 rule if your LAN uses IPv6.

Traffic you trust (backups to a known server, for example) can stay on a rule without divert, placed above.

3. Drop what the rules find

  1. Services › Intrusion Detection › Policy, click +.
  2. Rulesets: start with the high-confidence ones: emerging-malware, emerging-exploit, emerging-exploit_kit, emerging-phishing, emerging-coinminer, emerging-attack_response, botcc, compromised, and the abuse.ch sets.
  3. Action: Alert (the rules as they are); New action: Drop.
  4. Description: for example "drop malware and exploits". Save, then Apply.

Alerts in Administration › Alerts now say blocked for dropped traffic and allowed for what other rule sets only report.

If something legitimate is blocked

Open the alert in Administration › Alerts, note its SID, and in the Rules tab set that rule to Alert or disable it, then Apply. Or narrow the policy's rule sets.

Performance

Inline inspection costs CPU. In our lab, 2 vCPUs carried about 1 Gbit/s with the protection rule set; for busy links give gate42 4 vCPUs and 8 GB. On the Settings tab, Listeners sets how many divert listeners share the work (one per vCPU).

Switch back

Capture mode PCAP live mode (IDS), remove the Divert-to from the rules, Apply on both pages.