AWS pfSense pfBlockerNG Suricata

[pshk]

I setup a pfSense firewall in AWS and have some question
The setup is like this
igw
-> public subnet
-> pfsense firewall
-> private subnet
-> transit gateway
-> other VPC

then I create a public access Network Load Balancer, which has a public ip, a public subnet ip and is targeting to a web server in other VPC

It was OK when I only setup pfSense only. I can access the web server
then I added pfBlockerNG, it still ok
but after I start Suricata, it failed
I added the IP in the pass list but no luck
then I tried to fallback, stop the Suricata, it still failed

My question is:

1. Do I need both pfBlockerNG and Suricata? or only one of them is enough?
2. How do I unblock an IP in the suricata?