Enable and Tune Suricata IDS/IPS on pfSense

Before you run this

Suricata is a deep-packet inspection engine. In IDS mode it watches a copy of the traffic on an interface and raises alerts; in IPS mode it actively blocks hosts or drops packets that match a rule. That second mode is the dangerous one: a noisy or badly tuned rule can block a legitimate host — including your own management workstation — and cut production traffic. Treat this as a change to a live firewall, not a lab toy.

• Privileges: everything here is done in the pfSense web GUI as an administrator. The standard path needs no shell. If you drop to a console it is for verification only.
• Test first, block later. Read what each rule category does, run Suricata in alert-only (IDS) mode for at least a few days, watch the alerts, and only enable blocking once you understand what it flags in your environment. If you have a spare box or VM, stand it up there first.
• IPS mode changes/drops traffic and can lock you out. It is not "irreversible" in the file sense — you can uninstall it — but a block that fires mid-change can drop your session instantly.
• Keep an out-of-band path open. Have console/serial or a separate LAN-side connection you can reach the box on, so that if Suricata blocks your admin IP you can still get in and turn it off.
• Back up the config first: Diagnostics → Backup & Restore → Download configuration as XML. Do this before you touch anything, and make the change in a maintenance window.
• Rollback path: the fastest undo is to edit the interface and clear Block Offenders, or stop the service under Services → Suricata. A full revert is Diagnostics → Backup & Restore → Restore from the XML you saved, or uninstalling the package under System → Package Manager.

Environment I'm assuming: pfSense CE 2.7.x with the Suricata package (Suricata 7.x). OPNsense ships Suricata built in under Services → Intrusion Detection — the concepts map one-to-one but the menus differ; I note the OPNsense equivalents at the end.

1. Install the package

System → Package Manager → Available Packages, find Suricata, click Install, confirm. When it finishes you get a new menu item at Services → Suricata.

2. Global settings — pick your rule sources

Go to Services → Suricata → Global Settings.

• Enable ET Open (Emerging Threats Open) rules — this is the free, well-maintained default rule set and the right starting point.
• Snort VRT rules require a free or paid Snort "oinkcode"; leave it off unless you have one.
• The Snort GPLv2 Community Rules and the ABUSE.ch / Feodo feeds are optional extras; you can add them later once the basics are stable.
• Set an Update Interval (12 or 24 hours is normal) and an update start time.
• Set the Remove Blocked Hosts Interval so blocked IPs age out rather than pile up forever.

Save, then go to the Updates tab and click Update to download the rules for the first time. Nothing is enforced yet — you have no interface configured.

3. Add and configure an interface

Interfaces tab → Add.

Where to run it. The two common placements:

• WAN — sees everything hitting your edge, but source IPs on inbound blocks are internet hosts and inbound traffic is largely already dropped by your firewall rules.
• LAN — sees post-NAT internal client IPs, which makes alerts and blocks far more actionable for outbound/lateral threats.

For most people LAN is the more useful sensor. Many run both. Pick one to start.

On the interface edit page:

• Enable the interface.
• Leave Block Offenders unchecked for now — this keeps you in IDS/alert-only mode.
• Set Send Alerts to System Log if you want them in the main log as well as Suricata's own.
• Leave the pattern matcher / detect-engine performance options at their defaults unless you have a documented reason to change them; the defaults are sane.

Save.

4. Choose rule categories

Open the interface's Categories tab. Rather than hand-pick hundreds of category files, use the built-in IPS policy: tick Use IPS Policy and choose one:

• Connectivity — fewest false positives, lightest.
• Balanced — the sensible default to start with.
• Security — more aggressive, more false positives.
• Max-Detect — everything; expect a lot of noise.

Start on Balanced. Save. Then go to Services → Suricata, and start Suricata on the interface (the play icon). Give it a minute to load the rules.

5. Run in IDS mode and read the alerts

Let it run. Watch the interface's Alerts tab (and Status → System Logs). You are looking for two things: real threats, and false positives — rules firing on traffic you know is legitimate (a backup job, a monitoring probe, an internal app).

This watching period is the whole point. Do not skip to blocking.

6. Tune out the false positives

For a rule that is clearly a false positive in your network, suppress it rather than disabling the whole category:

• On the Alerts tab, each alert row has icons to suppress that signature (by GID:SID) or add its source/destination to a pass list. pfSense writes this to the interface's Suppress List.
• Manage suppress lists under the Suppress tab and pass lists under Pass Lists. Apply a suppress list to the interface via its settings, then restart Suricata on that interface for it to take effect.

Suppress the noise; keep the real detections. Repeat over several days until the alert stream is mostly meaningful.

7. Turn on IPS (blocking)

Only now, in your maintenance window, enable enforcement. Edit the interface:

• Check Block Offenders.
• IPS Mode — pfSense offers Legacy Mode and Inline Mode:
  • Legacy Mode copies packets, and when a rule fires it inserts the offending IP into a pf block table. Simple, works on any NIC. It blocks after the first offending packet passes.
  • Inline Mode puts Suricata in the packet path (via netmap) so it can drop the matching packet outright. It requires a NIC/driver with netmap support and can affect throughput. Do not switch to Inline blind — check the pfSense Suricata documentation for supported drivers first.
• In Legacy mode set Which IP to Block (Source / Destination / Both) — Both is the usual choice — and decide whether to Kill States for a blocked host.

Start with Legacy Mode. Save, then restart Suricata on the interface.

Before you walk away, add your management network to a Pass List and apply it to the interface, so a false positive can never block your own admin access. This is the single most important safety step in IPS mode.

8. Verify it's working

• Services → Suricata shows the interface running (green).
• The Alerts tab keeps populating.
• Once in IPS mode, the Blocks tab lists currently blocked IPs; you can clear individual entries there.
• Optional, from Diagnostics → Command Prompt or a console shell, confirm the process is up:

# Is the Suricata process running?
ps -ax | grep suricata

• Generate a controlled test alert if you like — for example, request the EICAR test string or a known ET-flagged pattern from a throwaway host — and confirm it shows up (and, in IPS mode, that the host gets blocked and then cleared).

Undo / rollback

• Stop blocking, keep watching: edit the interface, uncheck Block Offenders, save, restart.
• Stop entirely: stop the service under Services → Suricata.
• Unblock a host now: Blocks tab → remove the entry (and clear its state if needed).
• Remove completely: System → Package Manager → Installed Packages → Suricata → Uninstall, or restore the XML config you saved in step 0.

OPNsense in one paragraph

On OPNsense there's no package to install: go to Services → Intrusion Detection → Administration. The Settings tab has Enabled, an IPS mode checkbox, Promiscuous mode, the interface selector, and Home networks. Rule sets are enabled under the Download tab and refreshed there; per-signature tuning is on the Rules tab; alerts appear under Alerts. Same discipline applies: enable it as IDS, watch, tune, then tick IPS mode. For exact field behaviour, follow the OPNsense documentation's Intrusion Detection section rather than guessing.