Skip to main content
Intrusion prevention system
Last update:

Intrusion prevention system

Working principle⁠

An IPS, or Intrusion Prevention System, is an optional security system within a firewall. The system is capable of detecting and alerting on almost all types of network attacks, as well as blocking detected attacks.

In Selectel firewall IPS is implemented as a Snort-based software module. Checks traffic that has already passed firewall filtering. Regularly updated rules from the Snort development community are used to inspect traffic, and you can also add your own rules to detect and block network attacks.

Restrictions⁠

IPS on the Selectel firewall does not protect against the following types of attacks:

  • application logic attacks (L7). For protection at this level, use WAF Qrator;
  • any non-network attacks, such as obtaining user super rights.

Cost⁠

You can connect IPS on a Selectel firewall for free. Only the firewall is payable, see Hardware Firewall Payment Model and Pricing for details.

Connect IPS⁠

  1. Ensure that you order a Selectel firewall and access the GUI.
  2. Configure the IPS module.
  3. Add and configure network interface.
  4. Configure existing rules.
  5. Optional: create your own rules.
  6. Enable IPS on interface.

Configure the IPS module⁠

  1. In the GUI main menu, go to Services → Snort.
  2. Open the Global settings tab.
  3. Select the repositories from which you want to use the rules by checking the Click to enable download of ... checkboxes.
  4. Optional: set the settings in the Rules Update Settings and General Settings blocks.
  5. Press Save.
  6. Open the Updates tab.
  7. To download the selected rule repositories, click Update Rules.
  8. Optional: set the settings on the other tabs.

Add and configure the network interface⁠

  1. In the GUI main menu, go to Services → Snort.

  2. Open the Snort Interfaces tab.

  3. Press + Add.

  4. Select the interface on which you want to enable IPS.

  5. Optional: To display the IPS log in the overall firewall log, in the Alert Settings block, check the Send Alerts to System Log checkbox.

  6. In the Block Settings box, check the Block Offenders checkbox.

  7. Select the lock mode (IPS Mode):

    • Legacy mode — suspicious traffic sources are blocked, some amount of suspicious traffic may enter the system until blocked;
    • Inline mode — suspicious traffic packets are blocked without entering the system.

  8. Optional: specify settings in other blocks on the page.

  9. Press Save.

  10. Optional: to reduce false positives, go to the Variables tab and specify the IP addresses and ports of your servers.

Customize existing rules⁠

  1. In GUI in the main menu, go to Services → Snort.

  2. Open the Snort Interfaces tab.

  3. In the row of the desired interface, click .

  4. Open the Rules tab.

  5. Check if the rules from the selected categories are enabled. In the Available Rule Categories block select a category, in the State column check/set the required state for the desired rules.

  6. If when configuring the module you selected Inline mode, in the Action column, change the action of the rule:

    • DEFAULT — sets the default action of the rule, usually ALERT;
    • ALERT — create a log entry;
    • DROP — discard package;
    • REJECT — discard the packet and send a port unavailability message in response.

  7. Press Apply.

Create your own rules⁠

  1. In GUI in the main menu, go to Services → Snort.
  2. Open the Snort Interfaces tab.
  3. In the row of the desired interface, click .
  4. Open the Rules tab.
  5. In the Available Rule Categories block, select custom.rules.
  6. In the Defined Custom Rules block, enter the text of the rules in Snort format.
  7. Press Save.

Enable IPS on the interface⁠

  1. In the GUI main menu, go to Services → Snort.

  2. Open the Snort Interfaces tab.

  3. In the row of the desired interface, click . IPS will start working, logs will be displayed:

    • in the general Snort logs (Services → Snort → Alerts tab);
    • in the interface logs (Services → Snort → in the line of the required interface → Logs tab).

  4. Optional: To disable IPS on an interface, in the row of the desired interface, click .