Suricata configruation question

[Vincent Chen]

Hi all,

My wan use pppoe to get a public ipv4, services are port forwarded to dmz subnet.

I got suricata enabled for a while. I have <wan ip>/32,<dmz net>/24 defined as homenet.

If I enable ips on dmz, traffic pass or block as rules defined. But transfer from dmz will slow down because packet inspect.
If I enable ips only on wan, no alter at all. But transfer from dmz will be full speed.

Here is my question:
Threats usually come from wan then pass to dmz. Why enable ips only on wan not block anything or alert anything.


Thanks for any help,

[BoNetTech]

Hi Vincent,

A few thoughts, since the behaviour differs between WAN and DMZ:

1) PPPoE + IPS. IPS mode (netmap) is a known limitation on PPPoE interfaces, while IDS (pcap) works on the virtual pppoe interface. The usual suggestion from the OPNsense developers is to run IPS on an internal interface (here your DMZ) and, if you also want visibility on the WAN, use IDS there. Which mode are you using on the WAN?

2) What the WAN sees. Inbound traffic is inspected before port forwarding, with your public IP as destination, while the DMZ interface sees the translated traffic. The documentation also notes that IPS on the WAN adds little, since the firewall already drops unsolicited traffic, and that NAT hides internal addresses there.

3) Home networks. The docs advise against using an external address as home network; since a PPPoE address can change, a fixed <wan ip>/32 would also become wrong after a reconnect.

4) Alert vs drop. A packet is only dropped if the rule action is drop (per rule or per policy). Check Services > Intrusion Detection > Alerts and your policies.

5) Hardware offloading. For IPS mode the docs ask to disable all hardware offloading features under Interfaces > Settings.

6) Slow DMZ transfers. Enable only the rulesets that match what you actually expose (web, mail, ...); a large ruleset on a small CPU slows transfers noticeably.

Which OPNsense version are you on, and which capture mode (PCAP, Netmap, Divert)?

— Sergio

[Vincent Chen]

Hi Vincent,

A few thoughts, since the behaviour differs between WAN and DMZ:

1) PPPoE + IPS. IPS mode (netmap) is a known limitation on PPPoE interfaces, while IDS (pcap) works on the virtual pppoe interface. The usual suggestion from the OPNsense developers is to run IPS on an internal interface (here your DMZ) and, if you also want visibility on the WAN, use IDS there. Which mode are you using on the WAN?

yes, I set capture mode to Netmap

2) What the WAN sees. Inbound traffic is inspected before port forwarding, with your public IP as destination, while the DMZ interface sees the translated traffic. The documentation also notes that IPS on the WAN adds little, since the firewall already drops unsolicited traffic, and that NAT hides internal addresses there.

3) Home networks. The docs advise against using an external address as home network; since a PPPoE address can change, a fixed <wan ip>/32 would also become wrong after a reconnect.

ok, I will remove wan ip and only keep dmz

4) Alert vs drop. A packet is only dropped if the rule action is drop (per rule or per policy). Check Services > Intrusion Detection > Alerts and your policies.

5) Hardware offloading. For IPS mode the docs ask to disable all hardware offloading features under Interfaces > Settings.

hardware offloading seems disabled by default in 26.7.7

6) Slow DMZ transfers. Enable only the rulesets that match what you actually expose (web, mail, ...); a large ruleset on a small CPU slows transfers noticeably.

Which OPNsense version are you on, and which capture mode (PCAP, Netmap, Divert)?


Thank you very much for helping me better understanding. I did not know pppoe limitation on ips system.
I am using N100 with 8g ram and 4 i226v nic. This unit seems not capable to handle 2.5g transfter if
ips enabled. iperf3 test can reach 2.3g but dmz scp only give me 1.5g ~ 1.7g. May I should consider to
upgrade this N100 unit.

[BoNetTech]

Hi Vincent,

Glad it helped. Before replacing the N100, I would measure what is really the limit, because scp may be the bottleneck and not Suricata: scp encrypts everything in a single thread, and on an N100 it often tops out around 1.5 to 2 Gbit/s even with the IPS switched off.

A quick way to separate the two:

1) Run the same iperf3 test to the DMZ with the IPS on and with the IPS off, using four parallel streams. If the two results are close, Suricata is not your limit.

2) Repeat the scp test with the IPS off. If it is still around 1.7 Gbit/s, that is the scp and CPU limit, not the IPS.

3) While a test runs, look at the CPU usage on the Dashboard. If one core is at 100 percent, that tells you where the limit is.

If the IPS really costs you a lot of throughput, enable only the rulesets that match what you expose in the DMZ, such as web and mail. I have not tested this exact combination of N100, i226-V and netmap, so please take this as a suggestion to measure, not as a verified result.

If the IPS still limits you after that, a faster CPU is the logical upgrade, but I would measure first.

Sergio