The documentation of the Intrusion Prevention System shows the service enabled on both RED and GREEN zones, and states that “At least one network zone has to be selected. All traffic coming from, or going to that zone is being passed to the IPS and being filtered.”
So my question is: if I enable IPS on both the RED and GREEN zones will the traffic be analyzed twice and will this affect performance? In this case, is it better to enable it only on either RED or GREEN, and which one?
I hope I’m not asking a trivial question, I tried to look for information about this but could not find any. Maybe this should be better detailed in the IPS documentation.
One advantage to enabling it on GREEN is that you can tell if any LAN devices may potentially be infected because a scan of GREEN will give you individual LAN IPs as source or destination while a scan of RED will just give the public-facing IP.
No, the traffic will never be passed more than once because that would not make much sense.
The reason why you can enable different interfaces is so that you can ignore an entire network segment if you wish to do so. I don’t really see any reason why you should not scan all traffic though.
Once you have enabled a zone and a packet is either going in or out of that zone, the packet will be scanned. So if you only have RED enabled, and a client from the GREEN network is downloading something from the internet (which is RED), that data will be scanned. If that same client is downloading something from a server in the ORANGE zone, that data won’t be scanned. If RED and GREEN are enabled, any packet that is passing through the firewall from any client on the GREEN network will be scanned.
Internally, the firewall will mark any packets that have already been sent to the IPS for performance reasons.
@ms following your post I attempted to enable IPS with all IPFire DBL domain blocklists on all zones. I then realized that the “doh” blocklist should not be enabled on RED, otherwise for instance the web proxy will not be able to access the Internet. So I am now forced either to disable the “doh” blocklist for all zones, or otherwise to exclude the RED zone altogether from IPS. I actually would like to enable IPS on all zones, and customize the blocklists ruleset for the RED zone only. This could be achieved for instance by adding an “Exclude from RED zone” flag for each blocklist within the ruleset customization page, or otherwise by allowing to select enabled zones separately for each blocklist. I would like to ask if you agree on this and if I should open a feature request.
thanks for your suggestion, but Suricata does not support what you are describing here at this point.
You are also trying to create a setup which does not make a lot of sense in my book. So if you want to stop your network from using DoH by enabling the rules in the IPS, why would you suddenly change your mind and want an exception?
The IPS is meant to be the backstop and it is there for analytics. It is not meant to be the primary blocker for what you want here. Have a look at the new DNS Firewall feature to realise what you are after.