What is the difference between an IDS and an IPS?

An IDS detects and alerts, while an IPS also blocks matching traffic inline. IPS mode risks blocking legitimate traffic, so tune in detection mode first.

Does encryption make network monitoring useless?

It hides payloads but not metadata such as destinations, timing, DNS queries, and TLS details. Endpoint logs and proxies fill the gaps, and encryption remains essential for privacy and security.

Network Defense: Firewalls, Segmentation, and Suricata IDS

Introduction

Assume that one machine will eventually be compromised. Good network design limits the damage by controlling what can talk to what, and monitoring catches suspicious behavior early. This lesson covers firewalls, segmentation, and intrusion detection with Suricata, an open-source engine.

Prerequisites

Basic networking: subnets, ports, TCP and UDP
The Linux hardening lesson helps

Step-by-Step Guide

Step 1: Think in zones and trust levels

Group systems by function and sensitivity: public-facing web servers, internal application servers, databases, user devices, and management networks. Place each group in its own network segment, and allow only the traffic each group truly needs. A web server should reach the application tier on one port, and the database should accept connections only from the application tier, not from the internet or from user laptops.

Internet -> [Firewall] -> DMZ: web servers
                           |
                  [Firewall rules] -> App tier -> [Firewall rules] -> Database tier
Users LAN and Management network: separate segments with their own rules

Step 2: Write firewall rules with default deny

Start by denying everything, then add specific allow rules, ideally in both directions, and review them regularly. Prefer rules that name sources, destinations, and ports precisely. Remove rules for systems that no longer exist. Rules that allow any source to any destination defeat the purpose.

# database server: only the app tier may reach MySQL
sudo ufw default deny incoming
sudo ufw allow from 10.0.2.0/24 to any port 3306 proto tcp
sudo ufw allow from 10.0.9.5 to any port 22 proto tcp   # admin host only

Step 3: Understand what an IDS does

An intrusion detection system watches network traffic and raises alerts when it matches known bad patterns or behavior. Suricata analyzes packets using rules and can also log protocol metadata such as DNS queries, HTTP requests, and TLS handshakes. It can run in detection-only mode, or in prevention mode where it drops matching traffic. Start in detection mode while you tune rules, so you do not block legitimate traffic.

Step 4: Install Suricata and update rules

On Ubuntu, Suricata is available from its project package repository, and the suricata-update tool downloads rulesets such as the free Emerging Threats Open rules. Set the HOME_NET variable in the configuration file to your internal ranges, and select the right network interface. Follow the official installation guide for your distribution, since package sources change.

sudo apt install -y suricata
sudo suricata-update
sudo suricata -T -c /etc/suricata/suricata.yaml   # test the configuration
sudo systemctl enable --now suricata

Step 5: Read the alerts and write a simple rule

Alerts are written to the eve.json log, which is structured JSON that a SIEM can ingest. A rule has an action, a protocol, source and destination, and options in parentheses. Custom rules go in a local rules file, with sid numbers of 1000000 and above reserved for local use. This example alerts on any DNS lookup for a domain you want to watch, such as a test domain in your lab.

# /var/lib/suricata/rules/local.rules
alert dns any any -> any any (msg:"LAB watched domain lookup"; dns.query; content:"bad.example.test"; nocase; sid:1000001; rev:1;)

# view alerts
sudo tail -f /var/log/suricata/eve.json | grep '"event_type":"alert"'

Step 6: Combine layers

No control is perfect, so layer them: segmentation limits movement, firewalls enforce policy, IDS detects what gets through, endpoint and log monitoring add visibility, and incident response handles the rest. Send Suricata and firewall logs to a central system, covered in the next lesson, and test your controls by running a lab scan and checking that your tools noticed.

FAQs

What is the difference between an IDS and an IPS?: An IDS detects and alerts, while an IPS also blocks matching traffic inline. IPS mode risks blocking legitimate traffic, so tune in detection mode first.
Does encryption make network monitoring useless?: It hides payloads but not metadata such as destinations, timing, DNS queries, and TLS details. Endpoint logs and proxies fill the gaps, and encryption remains essential for privacy and security.

Summary

Segment the network into zones, use default-deny firewall rules with precise allows, deploy Suricata in detection mode with updated rules and a correct HOME_NET, read eve.json alerts, and layer these controls with central logging.