Skip to main content
Intrusion prevention system
Last update:

Intrusion prevention system

Principle of operation⁠

The IPS (Intrusion Prevention System) is an optional security system within the Selectel firewall. IPS detects, blocks and alerts you to almost all types of network attacks.

Selectel IPS is implemented as a Snort-based software module in the Selectel firewall. The system inspects traffic that has already been filtered on the firewall.Regularly updated rules from the Snort development community are used to inspect traffic. You can add your own rules for detecting and blocking network attacks.

Limitations⁠

IPS on the Selectel firewall does not protect:

  • from attacks on application logic (L7). Use WAF Curator for protection at this level;
  • against any non-network attacks, such as user super rights.

Cost⁠

You can connect IPS on Selectel firewall for free.Only the firewall is paid for, more details in the article Hardware Firewall Payment Model and Pricing.

Connect IPS⁠

  1. Connect to the Selectel firewall.
  2. Configure the IPS module.
  3. Add and configure the network interface.
  4. Customize existing rules.
  5. Optional: create your own rules.
  6. Enable IPS on the interface.

1. Connect to a Selectel firewall⁠

  1. Open the page in your browser:

    https://<ip_address>:5443

    Specify <ip_address> — The IP address of the firewall.

  2. Enter the login and password you received in the ticket after ordering the firewall. The main page of the GUI with the dashboard opens.

2. Configure the IPS module⁠

  1. From the Services menu, go to the Snort section.
  2. Open the Global settings tab.
  3. For repositories with the desired rules, check the boxes Click to enable download of .....
  4. Optional: configure the update check intervals for enabled rule packs in the Rules Update Settings block.
  5. Optional: make general settings in the General Settings block.
  6. Click Save.
  7. Open the Updates tab.
  8. Click Update Rules and download the selected rule repositories.
  9. Optional: make the other settings.
  10. Click Save.

3. Add and configure the network interface⁠

  1. From the Services menu, go to the Snort section.

  2. Open the Snort Interfaces tab.

  3. Press + Add.

  4. Select the interface on which you want to enable IPS.

  5. Optional: To have the IPS log displayed in the overall firewall log, in the Alert Settings block, check the Send Alerts to System Log checkbox .

  6. In the Block Settings block, check the Block Offenders checkbox.

  7. In the IPS Mode field, select the lock mode:

    • Legacy mode — sources of suspicious traffic are blocked, some amount of suspicious traffic may enter the system before it is blocked;
    • Inline mode — blocks suspicious traffic packets from entering the system.

  8. Click Save.

  9. Optional: to reduce false positives, open the Variables tab and specify the IP addresses and ports of your servers.

4. Customize existing rules⁠

  1. From the Services menu, go to the Snort section.

  2. Open the Snort Interfaces tab.

  3. In the row of the desired interface, click .

  4. Open the Rules tab.

  5. In the Available Rule Categories block, select a category.

  6. In the State column, check the rules. If necessary, change the state of the rule.

  7. If you selected Inline mode when configuring the module in step 7, select the rule action in the Action column:

    • DEFAULT — set the default action of the rule, usually ALERT;
    • ALERT — create a log entry;
    • DROP — discard the package;
    • REJECT — discard the packet and send a port unavailability message in response.

  8. Click Apply.

5. Create your own rules⁠

  1. From the Services menu, go to the Snort section.
  2. Open the Snort Interfaces tab.
  3. In the row of the desired interface, click .
  4. Open the Rules tab.
  5. In the Available Rule Categories block, select custom.rules.
  6. In the Defined Custom Rules box, enter the text of the rules in Snort format. For more information, see the Writing Snort Rules article in the Snort documentation.
  7. Click Save.

6. Enable IPS on the interface⁠

  1. From the Services menu, go to the Snort section.
  2. Open the Snort Interfaces tab.
  3. In the row of the desired interface, click .
  4. Optional: to view Snort logs, go to Services → Snort → Alerts tab.
  5. Optional: to view the logs of a network interface, go to Services → Snort → in the row of the desired interface → Logs tab.