Skip to main content

Intrusion Prevention System

The documentation describes common scenarios and settings for the firewall. You can find advanced scenarios and a description of all settings in the official pfSense documentation.

How it works

The Intrusion Prevention System (IPS) is an additional security system included with Selectel firewalls. IPS detects and blocks almost all types of network attacks and sends alerts about them.

In the Selectel firewall, IPS is implemented as a software module based on Snort. The system inspects traffic that has already passed firewall filtering. Regularly updated rules from the Snort developer community are used to inspect traffic. You can add your own rules for detecting and blocking network attacks.

Limitations

The IPS on a Selectel firewall does not protect against:

  • from attacks on application logic (L7). To protect at this layer, use WAF;
  • against any non-network attacks, for example, gaining user superuser rights.

Pricing

You can enable IPS on a Selectel firewall for free. Only the firewall is paid; see more details in the Payment model and prices of hardware firewall instructions.

Connect IPS

  1. Connect to the Selectel firewall.
  2. Configure the IPS module.
  3. Add and configure a network interface.
  4. Configure existing rules.
  5. Optional: create your own rules.
  6. Enable IPS on the interface.

1. Connect to a Selectel firewall

  1. Open the following page in your browser:

    https://<ip_address>:5443

    Specify <ip_address> — the IP address of the firewall.

  2. Enter the username and password received in the ticket after ordering the firewall. The GUI home page with the dashboard will open.

2. Configure the IPS module

  1. In the Services menu, go to the Snort section.
  2. Open the Global settings tab.
  3. For repositories with the required rules, select the **Click to enable download of ** checkboxes.
  4. Optional: configure the update check frequency for enabled rule packages in the Rules Update Settings block.
  5. Optional: configure general settings in the General Settings block.
  6. Click Save.
  7. Open the Updates tab.
  8. Click Update Rules and download the selected rule repositories.
  9. Optional: configure other settings.
  10. Click Save.

3. Add and configure a network interface

  1. In the Services menu, go to the Snort section.

  2. Open the Snort Interfaces tab.

  3. Click + Add.

  4. Select the interface on which you want to enable IPS.

  5. Optional: so that the IPS log is displayed in the general firewall log, in the Alert Settings block, select the Send Alerts to System Log checkbox.

  6. In the Block Settings block, select the Block Offenders checkbox.

  7. In the IPS Mode field, select the blocking mode:

    • Legacy mode — sources of suspicious traffic are blocked, some suspicious traffic may enter the system before blocking;
    • Inline mode — suspicious traffic packets are blocked without entering the system.

  8. Click Save.

  9. Optional: to reduce the number of false positives, open the Variables tab and specify the IP addresses and ports of your servers.

4. Configure existing rules

  1. In the Services menu, go to the Snort section.

  2. Open the Snort Interfaces tab.

  3. In the row of the desired interface, click .

  4. Open the Rules tab.

  5. In the Available Rule Categories block, select a category.

  6. In the State column, check the rules. If necessary, change the state of the rule.

  7. If when configuring the module in step 7 you selected Inline mode, in the Action column, select the rule action:

    • DEFAULT — set the default rule action, usually ALERT;
    • ALERT — create a log entry;
    • DROP — drop the packet;
    • REJECT — drop the packet and return a port unreachable message in response.

  8. Click Apply.

5. Create custom rules

  1. In the Services menu, go to the Snort section.
  2. Open the Snort Interfaces tab.
  3. In the row of the desired interface, click .
  4. Open the Rules tab.
  5. In the Available Rule Categories block, select custom.rules.
  6. In the Defined Custom Rules block, enter the text of the rules in Snort format. For more information, see the Writing Snort Rules section in the Snort documentation.
  7. Click Save.

6. Enable IPS on the interface

  1. In the Services menu, go to the Snort section.
  2. Open the Snort Interfaces tab.
  3. In the row of the desired interface, click .
  4. Optional: to view Snort operation logs, go to Services → Snort → the Alerts tab.
  5. Optional: to view network interface operation logs, go to Services → Snort → in the row of the desired interface → the Logs tab.