Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Suricata with inline mode and problematic constelations

    Scheduled Pinned Locked Moved IDS/IPS
    2 Posts 2 Posters 356 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DaReaLDeviLD
      DaReaLDeviL
      last edited by

      Hi Folks,

      I'm actual running PFSense Version 2.4.2-RELEASE-p1 (amd64) with suricata 4.0.3_1 on ESXI 6.5 and Intel I350-T4 4xGBE NIC.

      And now I want to use Inline Mode couse I think it's a lot better couse no packet is crossing pfsense without being checked. So now I have 3 Networks behind with traffic shaping and openvpn. Is there any known drawback or issue with that kind of configuration or any other things that I need to know before running in all kind of issues?

      All plugins that I'm running:
      Open-VM-Tools 10.1.0,1  
      openvpn-client-export 1.4.14
      pfBlockerNG 2.1.2_2  
      suricata 4.0.3_1

      Regards

      VM PFSense 2.4.3 (amd64) on Dell PowerEdge T410
      Xeon E5620 @ 2.40GHz 2 CPUs: 4GB Ram: 60GB Disk
      ISP (MNet) 1xModem (Vigor 130) 1xWan, 3xLan (PFSense)

      1 Reply Last reply Reply Quote 0
      • D
        danjor404
        last edited by

        Hi DaReaLDeviL,

        Bill Meeks has a good explanation of what Inline Mode is and its benefits over Legacy Mode here:
          https://forum.pfsense.org/index.php?topic=108010.0

        The biggest issue with inline mode is hardware compatibility and stability.  When running as a physical machine FreeBSD's netmap only supports a limited number of NIC chipsets.  Supported list of adapters: https://www.unix.com/man-page/freebsd/4/netmap/

        But as for running it in a virtualized environment I'm not sure if pfSense's netmap supports vmware adapters.  Maybe someone has already tested and can chime in on this.  If it is supported I would think it would require you to configure SR-IOV (which your NIC does support) on your VMware Host.  If you're not in a production environment I'd say snapshot and see if it works.  Hope that helps.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.