Suricata configruation question

[Vincent Chen]

Hi all,

My wan use pppoe to get a public ipv4, services are port forwarded to dmz subnet.

I got suricata enabled for a while. I have <wan ip>/32,<dmz net>/24 defined as homenet.

If I enable ips on dmz, traffic pass or block as rules defined. But transfer from dmz will slow down because packet inspect.
If I enable ips only on wan, no alter at all. But transfer from dmz will be full speed.

Here is my question:
Threats usually come from wan then pass to dmz. Why enable ips only on wan not block anything or alert anything.


Thanks for any help,

[BoNetTech]

Hi Vincent,

A few thoughts, since the behaviour differs between WAN and DMZ:

1) PPPoE + IPS. IPS mode (netmap) is a known limitation on PPPoE interfaces, while IDS (pcap) works on the virtual pppoe interface. The usual suggestion from the OPNsense developers is to run IPS on an internal interface (here your DMZ) and, if you also want visibility on the WAN, use IDS there. Which mode are you using on the WAN?

2) What the WAN sees. Inbound traffic is inspected before port forwarding, with your public IP as destination, while the DMZ interface sees the translated traffic. The documentation also notes that IPS on the WAN adds little, since the firewall already drops unsolicited traffic, and that NAT hides internal addresses there.

3) Home networks. The docs advise against using an external address as home network; since a PPPoE address can change, a fixed <wan ip>/32 would also become wrong after a reconnect.

4) Alert vs drop. A packet is only dropped if the rule action is drop (per rule or per policy). Check Services > Intrusion Detection > Alerts and your policies.

5) Hardware offloading. For IPS mode the docs ask to disable all hardware offloading features under Interfaces > Settings.

6) Slow DMZ transfers. Enable only the rulesets that match what you actually expose (web, mail, ...); a large ruleset on a small CPU slows transfers noticeably.

Which OPNsense version are you on, and which capture mode (PCAP, Netmap, Divert)?

— Sergio