Suricata - Divert (IPS)

[jeffrey0]

For me my rule is simple, a new rule in Rules [New] on the WAN interface coming in to pass all traffic and Divert-to set to Intrusion Detection. This basically replicates my previous setup by capturing all packets for inspection, I don't want it to be more granular, maybe in an enterprise environment but not my homelab. The order is up to you, place the rule accordingly based on your other rules for the WAN interface.

NOTE: Divert-to is hidden and is only available in the "Advanced Mode", so be sure to enable that in the top left corner of the new rule dialog.

I use the WAN interface and add my ISP routers IP address to Home Networks in the suricata config, as far as I am aware this is the best method when using an IPS. As when on the LAN interface you may get more false positives and a lack of detection's since that interface is on your internal network. Intrusion attempts come from the external network in most cases, especially for homelab environments.

https://docs.opnsense.org/manual/ips.html#general-setup
https://docs.opnsense.org/manual/ips.html#advanced-options

Be careful: a broad WAN "pass any + divert-to" rule will effectively allow all inbound traffic on WAN. That can expose services running on OPNsense itself (e.g. SSH, DNS, GUI) to the internet.

It likely makes more sense to apply divert-to only on the specific WAN allow rules / opened ports you actually intend to expose.

Thank you very much for this information!

[RamSense]

Oh? thanks for sharing. My assumption was that is was something like this: the divert rule -> suricate allows -> on to the next firewall rule in wan in line, but not allow all.
That makes this divert rather different than a "blocklist" block and on to the next rule concept...

[Monviech (Cedrik)]

Divert means that after the firewall match, the decision is totally "diverted" to what listens on the divert socket. No packet is passed back to the firewall to match another rule on the same interface afterwards.