Skip to main content
Intrusion prevention system
Last update:

Intrusion prevention system

Principle of operation⁠

The IPS (Intrusion Prevention System) is an optional security system within the Selectel firewall. IPS detects, blocks and alerts you to almost all types of network attacks.

In the Selectel firewall, IPS is implemented as a Snort-based software module. The system checks the traffic that has already passed firewall filtering. Regularly updated rules from the Snort development community are used to inspect traffic. You can add your own rules to detect and block network attacks.

Limitations⁠

IPS on the Selectel firewall does not protect:

  • from attacks on application logic (L7). For protection at this level, use WAF Curator;
  • against any non-network attacks, such as user super rights.

Cost⁠

You can connect IPS on a Selectel firewall for free. You only have to pay for the firewall, see the article for more details Hardware firewall payment and pricing model.

Connect IPS⁠

  1. Connect to the Selectel firewall.
  2. Configure the IPS module.
  3. Add and configure the network interface.
  4. Customize existing rules.
  5. Optional: create your own rules.
  6. Enable IPS on the interface.

1. Connect to the Selectel firewall⁠

  1. Open the page in your browser:

    https://<ip_address>:5443

    Specify <ip_address> — The IP address of the firewall.

  2. Enter the login and password you received in the ticket after the firewall order. The main page of the GUI with the dashboard will open.

2. Configure the IPS module⁠

  1. On the menu Services go to Snort.
  2. Open the tab Global settings.
  3. For repositories with the desired rules, check the checkboxes Click to enable download of ....
  4. Optional: configure the update check intervals for enabled rule packets in the block Rules Update Settings.
  5. Optional: make general settings in the block General Settings.
  6. Click Save.
  7. Open the tab Updates.
  8. Click Update Rules and download the selected rule repositories.
  9. Optional: make the other settings.
  10. Click Save.

3. Add and configure the network interface⁠

  1. On the menu Services go to Snort.

  2. Open the tab Snort Interfaces.

  3. Click + Add.

  4. Select the interface on which you want to enable IPS.

  5. Optional: to have the IPS log displayed in the overall firewall log, in the block Alert Settings check the box Send Alerts to System Log.

  6. In the block Block Settings check the box Block Offenders.

  7. In the field IPS Mode select the lock mode:

    • Legacy mode — sources of suspicious traffic are blocked, some amount of suspicious traffic may enter the system before it is blocked;
    • Inline mode — suspicious traffic packets are blocked without entering the system.

  8. Click Save.

  9. Optional: to reduce the number of false positives, open the tab Variables and specify the IP addresses and ports of your servers.

4. Customize existing rules⁠

  1. On the menu Services go to Snort.

  2. Open the tab Snort Interfaces.

  3. In the row of the desired interface, click .

  4. Open the tab Rules.

  5. In the block Available Rule Categories select a category.

  6. In the column State check the rules. If necessary, change the state of the rule.

  7. If at module configuration in step 7 you selected the mode Inline modein the column Action select a rule action:

    • DEFAULT — set the default action of the rule, usually ALERT;
    • ALERT — to create a log entry;
    • DROP — throw the bag away;
    • REJECT — discard the packet and send a port unavailability message in response.

  8. Click Apply.

5. Create your own rules⁠

  1. On the menu Services go to Snort.
  2. Open the tab Snort Interfaces.
  3. In the row of the desired interface, click .
  4. Open the tab Rules.
  5. In the block Available Rule Categories select custom.rules.
  6. In the block Defined Custom Rules enter the text of the rules in Snort format. Read more in the article Writing Snort Rules Snort documentation.
  7. Click Save.

6. Enable IPS on the interface⁠

  1. On the menu Services go to Snort.
  2. Open the tab Snort Interfaces.
  3. In the row of the desired interface, click .
  4. Optional: to view the Snort logs, go to Services → Snort → tab Alerts.
  5. Optional: To view the logs of the network interface, go to the section Services → Snort → in the row of the desired interface → tab Logs.