Enabling Suricata Rules on OPNsense Firewall
Do You Need to Enable Your IPS? (Suricata on OPNsense)?
Short answer is no, especially if you have no open ports or port forwarding. Suricata inspects all network traffic in and out of your network, providing an additional layer of security by spotting vulnerabilities and suspicious activity.
Backup Your OPNsense Firewall First
Before changes, always back up:
- Log in to your OPNsense machine
- Go to System > Configuration > Backups
- Select Download Configuration
See the Emerging Threats Rules list to know what will be blocked.
Enable Emerging Threats (ET) Open Rules in Suricata
Steps:
- Log into OPNsense Web GUI
- Navigate to Services > Intrusion Detection > Administration
- Check Enable at top if Suricata is off
- Also check IPS Mode
- Go to Download tab, under Rule Sets
- Enable Emerging Threats Open rule sets (enable what you need; more rules use more resources)
Common recommended rule categories:
| Category Name | Description | Why Enable? |
|---|---|---|
| emerging-exploit | Detect exploits against vulnerabilities | Captures common attack vectors on patchable software |
| emerging-malware | Malware communications and payloads | Blocks malware control and payload communication |
| emerging-scan | Network scanning detection | Detects attackers probing your network |
| emerging-phishing | Phishing URL and traffic detection | Prevents credential theft and social engineering |
| emerging-dos | Denial-of-service attack detection | Detects volume or targeted DoS attacks |
| emerging-attack_response | Post-exploitation attacker behavior | Spots lateral movement or persistence |
| emerging-botcc* | Botnet command & control | Prevents infected hosts from communicating with attackers |
| emerging-web_server | Web server attack prevention | Protects vulnerable web apps |
| emerging-ftp/smtp/dns/pop3 | Protocol-specific attacks | Covers common service attack vectors |
| emerging-snmp | SNMP protocol abuses | Detects infrastructure misuses |
| emerging-sql | SQL Injection and DB attacks | Protects against database attacks |
*If available in your rule set.
- Click Enable selected
- Go to Rules tab → Rules, enable rules as required
- Schedule automatic updates weekly under Schedule tab:
Minutes: 0
Hours: 0
Day of the month: 1
Months: *
Days of the week: *
- Save and apply changes.
Verify Emerging Threats is Working
- Enable SSH under System > Settings > Administration
- SSH into OPNsense:
ssh <username>@<opnsense_ip>
- Select option 8 for shell
- Run:
curl http://testmynids.org/uid/index.html
- Check logs at Services > Intrusion Detection > Administration > Alerts in the OPNsense dashboard
- Disable SSH in OPNsense dashboard if no longer needed.
Suricata now monitors your traffic using community-maintained Emerging Threats Open threat signatures.