Lab 07 IDS/IPS with Suricata and pfSense


Many users seem to think you can just install the Snort package and forget about it and your network will be protected. That's not true. You have to install the package, enable some rules, then start disabling false positives or adding suppress list entries for them. You have to analyze what types of assets you are protecting (web servers, mail servers, database servers, etc.) and set up either package keeping the defended networks/servers in mind. You set things like ports, operating system types, etc. Then you make sure the proper rules are active.

This lab introduces you to Suricata.

Lab Goal

Install Suricata on the pfSense box. For that purpose you may use the documentation from The steps are not labeled, but let me give you a few hints:

  1. Under System -> Package Manager -> Available Packages -> Surricata (install)

  2. Under Services -> Suricata -> Global Settings: Setup the rules

    1. You will need to setup an account on to get an oinkmaster code (hint: its in your profile), follow the link and directions on this pfSense page
    2. You will need to setup an account for the GeoLite2 database follow the directions on this pfSense page.

  3. Near the end, I got hung up on "Assigned Aliases" because there is no "ALIASES" button. Instead you can find Aliases listed under the Firewall menu.

Show Me

I am starting to add time limits to these labs. It should take you less than 2 minutes to show me the required material. Videos longer than 2 minutes will have points deducted 1 for every 5 seconds. Include voice over in your video to talk me through the elements.

  1. Show me your configuration:
    1. Walk me through your Suricata interfaces
      1. WAN Settings
      2. WAN Categories
      3. WAN Rules - make sure they reflect what is needed to protect your system.
    2. Walk me through the Global Settings (identify what you changed)
    3. Show me that your rule sets were updated after the Lab assignment was given.
  2. You man not have any alerts on your snort box yet because it is deeply buried behind layers of security already. For 50% of the lab points:

    1. Pick a rule that you have enabled (or that was enabled for you)
    2. Show that there is no alert for it.
    3. Try to violate the rule.
    4. Show that an alert has been logged and that the offending IP has been blocked.

== Figures ==