Deploying Suricata IDS/IPS on pfSense: A Practical Guide for Small‑Office Networks

Desired Outcome

Enable Suricata on one or more pfSense interfaces, configure rule sets, and verify that alerts or blocks are generated correctly without degrading network performance.

Prerequisites

• pfSense 2.7.x or newer (Suricata support is baked into the core).
• Minimum 2 GB RAM for moderate traffic; 4 GB or more recommended if you enable IPS mode on high‑traffic links.
• At least one dedicated CPU core or a system with hardware‑accelerated packet processing (e.g., Intel Xeon or AMD EPYC).
• Administrator access to the pfSense web UI and, optionally, SSH for log inspection.

Step‑by‑Step Configuration

1. Navigate to Suricata
   • From the pfSense dashboard, go to Services → IDS/IPS.
   • Click the Suricata tab.
   • Enable the toggle and select the interface(s) you want to monitor. For a typical home network, choose LAN and optionally WAN if you want outbound protection.
2. Choose the Rule Set
   • By default, Suricata downloads the ET Open rule set. This is sufficient for most small‑office environments.
   • To add custom rules, click Rules → Custom Rules and paste your Snort‑style rule(s). For example:

     alert http any any -> any any (msg:"Test HTTP rule"; flow:to_server,established; http_uri; uricontent:"/test"; sid:1000001; rev:1;)

   • After adding, click Save and Refresh the rule list.
3. Tune Performance
   • Open the Performance tab.
   • Adjust Max Open Files (default 1024) and Max Threads (default 4). Increase these values if you notice packet drops or high latency on busy interfaces.
   • Set Rule Cache Size to a value that balances memory usage and lookup speed (e.g., 200 M for 2000+ rules).
4. Select IPS Mode
   • In the General tab, choose Alert to log events or IPS to actively block traffic.
   • When using IPS mode, consider enabling Alert Only first to validate rule behavior before full blocking.
5. Apply and Restart
   • Click Save and then Apply Changes. Suricata will restart automatically on the chosen interface(s).
   • Verify the status: a green Running icon appears next to the interface name.

Verification Checks

• Interface Status
  • Go to Services → IDS/IPS → Suricata and confirm the interface shows Running.
  • Check the Status tab for a brief summary of active rules and connection counts.
• Log Review
  • Navigate to Status → System Logs → IDS to see real‑time alerts.
  • For IPS mode, look for Blocked entries.
  • Use the Search box to filter by rule ID or message text.
• Packet Capture Test
  • On the same interface, open Status → Packet Capture.
  • Start a capture, generate a test HTTP request to /test (the custom rule above), and stop the capture.
  • Open the capture file and verify the packet is flagged by Suricata (look for the ETOPEN-HTTP-TEST or your custom SID).
• Log File Inspection
  • SSH into the pfSense host.
  • Run cat /var/log/suricata/suricata.log | grep -i test to see raw log entries for the rule.
  • Confirm timestamps match the test traffic and that the rule matched correctly.

Recovery Options

• Disable Suricata on an Interface
  • Return to Services → IDS/IPS, uncheck the interface, and apply changes. This stops Suricata without rebooting pfSense.
• Rollback Rule Changes
  • To remove a problematic rule, delete it from the Custom Rules list and refresh.
  • Alternatively, revert to the default ET Open set by disabling custom rules.
• Revert Performance Tuning
  • Reset Max Open Files, Max Threads, and Rule Cache Size to their default values if you experience instability.

Performance & Limitations

• Running Suricata on the WAN interface can introduce latency. Monitor latency and packet loss during peak hours before full deployment.
• Large rule sets (e.g., adding ET Pro) may consume >1 GB RAM. Use the Rule Set Size filter to limit active rules if memory is constrained.
• False positives are common; review alerts regularly and disable problematic signatures via the Disable button in the rule list.
• Suricata requires at least 2 GB RAM for moderate traffic; systems with less may crash or drop packets.
• IPS mode blocks traffic. Test thoroughly in a staging environment; consider a fallback interface if critical services are affected.

Conclusion

By following this guide you can deploy Suricata on pfSense with confidence, ensuring that alerts and blocks are generated appropriately while maintaining acceptable network performance. Regularly review logs, tune performance settings, and keep rule sets up‑to‑date to adapt to evolving threats.