Suricata, Questions Regarding Placement

Support
,
1

I am wondering what the typical placement/usage would be for using Nethserver as an IPS.

I have currently WAN to my router, router to Nethserver and other clients (typical home setup). So the router is between my wan and lan, but the Nethserver and other machines are all just members of the LAN communicating via the router.

Would I be correct in thinking that using Nethserver as an IPS would be most effective if the Nethserver is between the WAN and all the other machines on the network? Something like wan, nethserver, router/switch, client machines.

Otherwise its only monitoring/blocking traffic coming to it, right? It therefore wouldnt see traffic to all other client machines, or can it do this as I have it setup currently?

2

Yes, you are right, NethServer should be the gateway.

I’d put a router in front of NS, a switch can just stay in its network but it depends on your network setup and needs.

2 Likes
3

Ok so from the sounds of it I think the “right” approach to it (and what I thought it likely was) is it would be best to treat Nethserver/IPS as an appliance and position it in the network between wan and lan traffic?

I guess this as compared to having the Nethserver in my LAN, acting as a file server and adding IPS to it as that wouldnt really help the network, hypothetically it would only benefit the server (if setup correctly)?

4

Yes and you’ll get the full power out of Nethserver in gateway mode.