Skip to main content

Intrusion Prevention System

This documentation describes common scenarios and settings for the firewall. Advanced scenarios and a description of all settings can be found in the official pfSense documentation.

How it works

The Intrusion Prevention System (IPS) is an additional security system included with Selectel firewalls. IPS detects and blocks almost all types of network attacks and sends alerts about them.

In Selectel firewalls, IPS is implemented as a software module based on Snort. The system checks traffic that has already passed firewall filtering. Regularly updated rules from the Snort developer community are used to inspect traffic. You can add your own rules for detecting and blocking network attacks.

Limitations

The IPS on a Selectel firewall does not protect against:

  • against attacks on application logic (L7). To protect at this level, use WAF;
  • against any non-network attacks, for example, gaining user superuser rights.

Pricing

You can connect IPS to a Selectel firewall for free. Only the firewall itself is charged; for more details, see the Hardware Firewall Payment Model and Pricing guide.

Connect IPS

  1. Connect to a Selectel firewall.
  2. Configure the IPS module.
  3. Add and configure a network interface.
  4. Configure existing rules.
  5. Optional: create custom rules.
  6. Enable IPS on the interface.

1. Connect to a Selectel firewall

  1. Open the following page in your browser:

    https://<ip_address>:5443

    Specify <ip_address> — the IP address of the firewall.

  2. Enter the login and password received in the ticket after ordering a firewall. The main page of the graphical interface with the dashboard will open.

2. Configure the IPS module

  1. In the Services menu, go to the Snort section.
  2. Open the Global settings tab.
  3. For repositories with the necessary rules, check the **Click to enable download of ** checkboxes....
  4. Optional: configure the frequency of update checks for the enabled rule packages in the Rules Update Settings block.
  5. Optional: perform general configuration in the General Settings block.
  6. Click Save.
  7. Open the Updates tab.
  8. Click Update Rules and download the selected rule repositories.
  9. Optional: configure other settings.
  10. Click Save.

3. Add and configure a network interface

  1. In the Services menu, go to the Snort section.

  2. Open the Snort Interfaces tab.

  3. Click + Add.

  4. Select the interface on which you want to enable IPS.

  5. Optional: to display the IPS log in the general firewall log, in the Alert Settings block, check the Send Alerts to System Log checkbox.

  6. In the Block Settings block, check the Block Offenders checkbox.

  7. In the IPS Mode field, select the blocking mode:

    • Legacy mode — suspicious traffic sources are blocked; some suspicious traffic may reach the system before the block is applied;
    • Inline mode — suspicious traffic packets are blocked before they reach the system.

  8. Click Save.

  9. Optional: to reduce the number of false positives, open the Variables tab and specify the IP addresses and ports of your servers.

4. Configure existing rules

  1. In the Services menu, go to the Snort section.

  2. Open the Snort Interfaces tab.

  3. In the row for the required interface, click .

  4. Open the Rules tab.

  5. In the Available Rule Categories block, select a category.

  6. In the State column, check the rules. If necessary, change the rule state.

  7. If you selected Inline mode at step 7 when configuring the module, in the Action column, select a rule action:

    • DEFAULT — set the default rule action, typically ALERT;
    • ALERT — create a log entry;
    • DROP — drop the packet;
    • REJECT — drop the packet and send a port unreachable message in response.

  8. Click Apply.

5. Create custom rules

  1. In the Services menu, go to the Snort section.
  2. Open the Snort Interfaces tab.
  3. In the row for the required interface, click .
  4. Open the Rules tab.
  5. In the Available Rule Categories block, select custom.rules.
  6. In the Defined Custom Rules block, enter the rule text in Snort format. For more details, see the Writing Snort Rules section of the Snort documentation.
  7. Click Save.

6. Enable IPS on the interface

  1. In the Services menu, go to the Snort section.
  2. Open the Snort Interfaces tab.
  3. In the row for the required interface, click .
  4. Optional: to view Snort operation logs, go to Services → Snort → Alerts tab.
  5. Optional: to view network interface logs, go to Services → Snort → in the row for the required interface → Logs tab.