Suricata with inline mode and problematic constelations



  • Hi Folks,

    I'm actual running PFSense Version 2.4.2-RELEASE-p1 (amd64) with suricata 4.0.3_1 on ESXI 6.5 and Intel I350-T4 4xGBE NIC.

    And now I want to use Inline Mode couse I think it's a lot better couse no packet is crossing pfsense without being checked. So now I have 3 Networks behind with traffic shaping and openvpn. Is there any known drawback or issue with that kind of configuration or any other things that I need to know before running in all kind of issues?

    All plugins that I'm running:
    Open-VM-Tools 10.1.0,1  
    openvpn-client-export 1.4.14
    pfBlockerNG 2.1.2_2  
    suricata 4.0.3_1

    Regards



  • Hi DaReaLDeviL,

    Bill Meeks has a good explanation of what Inline Mode is and its benefits over Legacy Mode here:
      https://forum.pfsense.org/index.php?topic=108010.0

    The biggest issue with inline mode is hardware compatibility and stability.  When running as a physical machine FreeBSD's netmap only supports a limited number of NIC chipsets.  Supported list of adapters: https://www.unix.com/man-page/freebsd/4/netmap/

    But as for running it in a virtualized environment I'm not sure if pfSense's netmap supports vmware adapters.  Maybe someone has already tested and can chime in on this.  If it is supported I would think it would require you to configure SR-IOV (which your NIC does support) on your VMware Host.  If you're not in a production environment I'd say snapshot and see if it works.  Hope that helps.


Log in to reply