---
title: "Intrusion Prevention System"
sidebar_label: "Intrusion Prevention System"
sidebar_position: 11
description: "Intrusion Prevention System (IPS) on a Selectel firewall: operating principle, limitations, pricing, and how to connect"
---

import Formbricks from '@theme/MDXComponents/Formbricks';
import EditIcon from '@selectel/docux/icons/edit';
import PlayCircleIcon from '@selectel/docux/icons/play-circle';
import PfsenseAlert from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/firewalls/selectel/pfsense-alert.mdx';

# Intrusion Prevention System

<PfsenseAlert />

## How it works \{#principle-of-operation}

Intrusion Prevention System (IPS) is an additional security system included with the Selectel firewall. The IPS detects and blocks almost all types of network attacks and provides notifications about them.

In the Selectel firewall, IPS is implemented as a software module based on Snort. The system checks traffic that has already passed [firewall filtering](/firewalls/selectel/configure-firewall-rules.mdx). To check traffic, regularly updated rules from the Snort development community are used. You can add your own rules for detecting and blocking network attacks.

## Limitations \{#restrictions}

The IPS on a Selectel firewall does not protect against:

* from application-layer (L7) attacks. To protect at this level, use [WAF](/waf/);
* against any non-network attacks, for example, gaining user superuser rights.

## Pricing \{#price}

You can connect IPS to a Selectel firewall for free. Only the firewall itself is charged; for more details, see the instructions [Hardware Firewall Payment Model and Prices](/firewalls/about/payment-hardware.mdx).

## Connect IPS \{#enable-ips}

1. [Connect to a Selectel firewall](#connect-to-firewall).
2. [Configure the IPS module](#configure-ips-module).
3. [Add and configure a network interface](#add-and-configure-network-interface).
4. [Configure existing rules](#configure-existing-rules).
5. Optional: [create custom rules](#create-rules).
6. [Enable IPS on the interface](#enable-ips-on-interface).

### 1. Connect to a Selectel firewall \{#connect-to-firewall}

1. Open the following page in your browser:

   ```bash
   https://<ip_address>:5443
   ```

   Specify `<ip_address>` — the IP address of the firewall.

2. Enter the username and password received in the ticket after [ordering a firewall](/firewalls/order/order-hardware-firewall.mdx). The main page of the graphical interface with the dashboard will open.

### 2. Configure the IPS module \{#configure-ips-module}

1. In the **Services** menu, go to the **Snort** section.
2. Open the **Global settings** tab.
3. For repositories with the necessary rules, check the \*\*Click to enable download of \*\* checkboxes....
4. Optional: configure the frequency of update checks for the enabled rule packages in the **Rules Update Settings** block.
5. Optional: perform general configuration in the **General Settings** block.
6. Click **Save**.
7. Open the **Updates** tab.
8. Click **Update Rules** and download the selected rule repositories.
9. Optional: configure other settings.
10. Click **Save**.

### 3. Add and configure a network interface \{#add-and-configure-network-interface}

1. In the **Services** menu, go to the **Snort** section.

2. Open the **Snort Interfaces** tab.

3. Click **+ Add**.

4. Select the interface on which you want to enable IPS.

5. Optional: to display the IPS log in the general firewall log, in the **Alert Settings** block, check the **Send Alerts to System Log** checkbox.

6. In the **Block Settings** block, check the **Block Offenders** checkbox.

7. In the **IPS Mode** field, select the blocking mode:

   * **Legacy mode** — suspicious traffic sources are blocked; some suspicious traffic may reach the system before the block is applied;
   * **Inline mode** — suspicious traffic packets are blocked before they reach the system.

8. Click **Save**.

9. Optional: to reduce the number of false positives, open the **Variables** tab and specify the IP addresses and ports of your servers.

### 4. Configure existing rules \{#configure-existing-rules}

1. In the **Services** menu, go to the **Snort** section.

2. Open the **Snort Interfaces** tab.

3. In the row of the required interface, click <EditIcon />.

4. Open the **Rules** tab.

5. In the **Available Rule Categories** block, select a category.

6. In the **State** column, check the rules. If necessary, change the state of the rule.

7. If you selected **Inline mode** at step 7 when [configuring the module](#configure-ips-module), in the **Action** column, select a rule action:

   * **DEFAULT** — set the default rule action, usually ALERT;
   * **ALERT** — create a log entry;
   * **DROP** — drop the packet;
   * **REJECT** — drop the packet and send a port unreachable message in response.

8. Click **Apply**.

### 5. Create custom rules \{#create-rules}

1. In the **Services** menu, go to the **Snort** section.
2. Open the **Snort Interfaces** tab.
3. In the row of the required interface, click <EditIcon />.
4. Open the **Rules** tab.
5. In the **Available Rule Categories** block, select **custom.rules**.
6. In the **Defined Custom Rules** block, enter the text of the rules in Snort format. For more details, see the [Writing Snort Rules](http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node27.html) section of the Snort documentation.
7. Click **Save**.

### 6. Enable IPS on the interface \{#enable-ips-on-interface}

1. In the **Services** menu, go to the **Snort** section.
2. Open the **Snort Interfaces** tab.
3. In the row of the required interface, click <PlayCircleIcon />.
4. Optional: to view Snort operation logs, go to **Services** → **Snort** → the **Alerts** tab.
5. Optional: to view network interface operation logs, go to **Services** → **Snort** → <EditIcon /> in the required interface's row → the **Logs** tab.

<Formbricks />