A good firewall never relies on a single layer. OPNsense combines the stateful firewall (pf) with Suricata (signature-based IDS/IPS) and CrowdSec (collaborative reputation IPS). The result: you block both known exploits and hostile behavior, with clear telemetry. A practical, step-by-step guide.
Why OPNsense
- Open-source, HardenedBSD — auditable code, weekly updates, no per-feature licensing.
- Plugin ecosystem — Suricata and CrowdSec are natively integrated, not hacks.
- Coherent UI + API — configure from the UI, or automate it.
- vs pfSense / Fortinet — open development model, fast pace; no subscription cost for IPS.
Architecture: layered defense
Traffic passes through three complementary filters. Suricata inspects packets by signature (known threats). The pf firewall applies stateful rules and NAT. CrowdSec decides, based on behavior and collaborative reputation, who gets blocked before reaching your services.
Preparation
- Interfaces — at least WAN + LAN. For inline IPS, place the sensor on the interface you want to inspect (typically WAN and/or LAN).
- IDS vs IPS — IDS only alerts; IPS blocks (drops) the packet. Start in IDS, switch to IPS after you reduce false positives.
- Hardware — inline Suricata is CPU-intensive; for >500 Mbps allocate 4+ cores and enough RAM for rulesets.
Step 1 — Suricata IDS/IPS
In OPNsense: Services → Intrusion Detection → Administration.
- Check Enabled and IPS mode (after the IDS test phase).
- Interfaces: select WAN (and LAN if you want internal inspection).
- Pattern matcher: Hyperscan if the CPU supports it (much faster).
- Download tab: enable rulesets — ET Open (Emerging Threats), Abuse.ch (feodo, sslbl), OPNsense rules. Schedule a daily update.
- Rules tab: enable relevant categories; disable noisy ones.
Critical for inline IPS: disable hardware offload on inspected interfaces, otherwise packets bypass netmap. Under Interfaces → Settings uncheck Hardware CRC / TSO / LRO. Check from the shell:
configctl ids status— service statustail -f /var/log/suricata/eve.json— live alerts
Step 2 — CrowdSec
Install the plugin: System → Firmware → Plugins → os-crowdsec. Components: engine (parses logs and decides) + firewall bouncer (enforces the block in pf via an alias/table).
- From Services → CrowdSec: enable engine + bouncer.
- Install relevant collections:
cscli collections install crowdsecurity/sshd crowdsecurity/http-cve crowdsecurity/base-http-scenarios - Check what runs:
cscli metrics,cscli decisions list,cscli alerts list. - Optional: enroll the instance in the CrowdSec console for a dashboard + community blocklists.
The bouncer creates a table that pf consumes; bad-scoring IPs are rejected before they touch your published services.
How Suricata + CrowdSec complement each other
- Suricata = signatures — catches exploits, malware payloads, known CVEs, in real time, inline.
- CrowdSec = behavior + reputation — catches brute-force, scanning, enumeration, and uses collective intelligence (IPs reported across the whole CrowdSec network).
- Together they cover both what you know (signatures) and what behaves badly (heuristics) — two different angles on the same traffic.
Testing and validation
- Suricata: trigger a test rule (e.g. a request to a flagged domain) and confirm the alert in
eve.json/ Alerts. In IPS mode the packet must be dropped. - CrowdSec: simulate SSH brute-force and check the decision appears:
cscli decisions list. Test the bouncer withcscli decisions add --ip 1.2.3.4 --duration 4hthen confirm the block. - Verify legitimate traffic is NOT affected (false positives) before leaving IPS on in production.
Tuning and operations
- Suricata false positives: disable noisy SIDs or suppress them; do not disable whole categories without reason.
- Performance: watch CPU; Hyperscan + the right core count matter. Inline adds latency — measure it.
- Maintenance: daily updates for rulesets and collections; check
cscli hub listfor updates. - Backup: export the OPNsense config before every major change.
When to choose this architecture
Ideal for SMB and remote sites that want enterprise protection without IPS licensing cost: a single OPNsense box delivers firewall, signature IDS/IPS and collaborative IPS, with clear telemetry and full control. We deploy it, tune it and monitor it for you.