Suricata IDS/IPS Setup: A Complete Tutorial for Ubuntu and Debian

Learn how to quickly install, configure, and switch between passive detection and active inline protection to secure your Linux environment using Suricata.

Introduction to Suricata

Ubuntu/Debian

Deep Dive into Network Security

Suricata is an open-source, high-performance Network Threat Detection engine that functions as an Intrusion Detection System (IDS) and Intrusion Prevention System (IPS). Developed by the Open Information Security Foundation (OISF), it monitors network traffic in real time to identify malicious activity, unauthorized access attempts, and policy violations. Unlike traditional packet sniffers, Suricata inspects both packet headers and payload data using a powerful signature-based rules engine to keep your infrastructure safe.

One of the standout features of Suricata is its modern multi-threaded architecture. This design allows it to split network traffic analysis across multiple CPU cores simultaneously, enabling seamless processing of high-speed, heavy-volume network traffic without causing hardware bottlenecks or dropping critical packets. Additionally, Suricata goes beyond standard signature matching by performing advanced protocol parsing, network flow tracking, and file extraction directly from intercepted network streams.

Suricata operates in two distinct modes depending on your security needs. In passive IDS mode, it analyzes copied network traffic via af-packet and alerts administrators without interfering with packet delivery. In active IPS mode, Suricata hooks directly into the Linux Netfilter framework via NFQUEUE, giving it the power to inspect packets inline and actively drop or reject malicious connections before they reach their target. It also generates clean JSON log outputs (EVE logs) that integrate seamlessly into central monitoring tools like Elastic Stack or Splunk.

Prerequisites

Operating System: An active installation of Ubuntu (20.04, 22.04, 24.04 LTS) or Debian (Debian 11 Bullseye or Debian 12 Bookworm).
User Privileges: Administrative access with sudo privileges or direct access to the root user account.
System Resources: Minimum 2 CPU cores and 2 GB RAM (higher network volume requires additional CPU cores and memory).
Network Access: Active internet access to download software packages, dependencies, and signature updates.
Networking Tools: Basic awareness of your active network interface name (such as eth0 or ens18).

Step-by-Step Installation

Update System Packages

Update your system package repository cache and install standard network dependencies.

BASH

sudo apt update && sudo apt upgrade -y
sudo apt install software-properties-common curl wget apt-transport-https jq lsb-release -y

Add Official Repositories

Select the repository command matching your Linux distribution

Add the official OISF repository for Ubuntu, or enable backports corresponding dynamically to your Debian release.

For Ubuntu Systems:

BASH

sudo add-apt-repository ppa:oisf/suricata-stable -y
sudo apt update

For Debian Systems (11 Bullseye or 12 Bookworm):

BASH

# Automatically detects if your system is bullseye or bookworm
DEBIAN_RELEASE=$(lsb_release -cs)
echo "deb http://deb.debian.org/debian ${DEBIAN_RELEASE}-backports main" | sudo tee /etc/apt/sources.list.d/backports.list
sudo apt update

Install Suricata Package

Install Suricata from the newly added repository sources.

For Ubuntu:

BASH

sudo apt install suricata -y

For Debian:

BASH

DEBIAN_RELEASE=$(lsb_release -cs)
sudo apt install suricata -t ${DEBIAN_RELEASE}-backports -y

Configure Network Variables and Interfaces

Map Suricata to your local IP address space and network interface card.

1. Locate your network interface name:

Bash

ip a

2. Open the main Suricata configuration file:

Bash

sudo nano /etc/suricata/suricata.yaml

3. Update the HOME_NET IP block to match your local network subnet:

YAML

vars:
  address-groups:
    HOME_NET: "[192.168.1.0/24]"
    EXTERNAL_NET: "!$HOME_NET"

4. Set your active network interface inside the af-packet section:

YAML

af-packet:
  - interface: eth0  # Replace eth0 with your network interface

Download Latest Threat Rules

Fetch the latest signature sets from the official Emerging Threats community feed.

BASH

sudo suricata-update

Configure Active IPS Mode (NFQUEUE)

Optional setup to switch from passive IDS mode to active inline IPS blocking mode

By default, Suricata operates as a passive IDS using af-packet. To switch to active Intrusion Prevention System (IPS) mode and safely block malicious traffic inline:

1. Update /etc/default/suricata to change the daemon startup mode from passive af-packet to active nfqueue:

BASH

sudo sed -i 's/LISTENMODE=af-packet/LISTENMODE=nfqueue/' /etc/default/suricata

2. Use the universal regular expression matcher re:. inside drop.conf to convert all alert rules into active drop rules:

BASH

echo "re:." | sudo tee /etc/suricata/drop.conf
sudo suricata-update

3. Route traffic into Netfilter queue 0 using iptables, appending --queue-bypass to ensure network connectivity remains active if the Suricata daemon stops:

BASH

sudo iptables -I INPUT -j NFQUEUE --queue-bypass
sudo iptables -I OUTPUT -j NFQUEUE --queue-bypass
sudo iptables -I FORWARD -j NFQUEUE --queue-bypass

Start and Enable the Suricata Service

Enable Suricata to automatically launch on system boot and start the daemon with your updated settings.

BASH

sudo systemctl enable suricata
sudo systemctl restart suricata
sudo systemctl status suricata

Verify Installation and Rule Action

Simulate an attack signature to verify fast.log logging and IPS drop actions

Run a test request that triggers signature ID 2100498 (GPL ATTACK_RESPONSE id check returned root).

1. Issue the test request from your server:

BASH

curl http://testmynids.org/uid/index.html

(In active IPS mode with drop rules enabled, the curl command will hang or time out because Suricata actively intercepts and drops the incoming payload).

2. Open a separate terminal window and inspect fast.log using the alert signature text or rule SID:

BASH

sudo grep "ATTACK_RESPONSE" /var/log/suricata/fast.log

(Alternatively, run sudo grep "2100498" /var/log/suricata/fast.log to confirm the log entry displays [Drop]).

By following this guide, you have successfully deployed and configured an enterprise-grade network security engine on your Linux server.

Package Installation: Added official software repositories and installed the latest stable Suricata release on Ubuntu or Debian.
Network Configuration: Mapped your local subnet (HOME_NET) and assigned your active network interface card inside suricata.yaml.
Signature Management: Updated threat detection signatures with suricata-update and converted standard alerts into active drop rules using drop.conf.
Inline IPS Routing: Configured iptables and Netfilter Queue (NFQUEUE) with --queue-bypass protection to block attack traffic inline without risking network lockouts.
System Verification: Validated threat detection and active packet drops against test signatures while monitoring /var/log/suricata/fast.log.

Your server is now equipped with a proactive defense layer capable of inspecting, detecting, and stopping malicious network traffic in real time.

Explore Dedicated Servers

CTCservers Recommended Tutorials

Discover CTCservers Dedicated Server Locations

CTCservers servers are available around the world, providing diverse options for hosting websites. Each region offers unique advantages, making it easier to choose a location that best suits your specific hosting needs.

North America

South America

Europe

Asia

Australia

Africa