Wheelhouse docs

Turn on Suricata IDS#

You will end up with Suricata inspecting your network, its rules fetched and kept current, and its alerts on a page in the web UI. This is detection: the engine watches a copy of the traffic and cannot block anything. Putting it in the path of the traffic is a different job — Put the engine in the packet path.

The router ships Suricata as part of its own configuration, so this is configuration like everything else: it is reviewed before it is applied, it rolls back, and it survives an image upgrade.

Before you start#

  • The operator role and a licence.
  • The LAN network. The engine needs to know which addresses are yours.
  • Headroom for the load. Suricata inspects packets on a general-purpose CPU; on a small box that is real work. No throughput figures are published, so try it on the interface you care about and watch the load.
  • Internet access from the router, for the rules.

Step 1 — Install the feature#

Services → Apps, find Suricata IDS, install it.

Suricata is a feature, not a container: a part of the router whose Wheelhouse page appears once it is installed. Installing it is instant and changes nothing on the router.

Two consequences:

  • Configuration outranks the flag. If the router already runs Suricata — set up by another operator, by anything — the IDS page shows regardless. Wheelhouse never hides configuration that exists.
  • Uninstalling while it is configured puts its removal in the pending changes for you to review, and the page stays until they are applied.

Step 2 — Turn it on#

Protect → IDS. With intrusion detection off, the page asks two questions.

Interfaces to inspect. The LAN side tells you which device each connection belongs to; the WAN side sees traffic before it is translated. Inspecting the LAN is usually what you want, because an alert that names 192.0.2.37 is actionable and an alert that names your public address is not.

Home networks. The networks the rules treat as yours; everything else is outside. The page suggests one from the inside interface's address and will not turn the engine on without one.

Turn on intrusion detection adds the service to the pending changes, with those two settings and the port groups the standard rules expect. Apply it, and the engine starts.

Step 3 — Fetch the rules#

Without rules the engine runs and matches nothing; the Rules tile says None. In the Rules panel, Update rules now fetches the current free rule set, checks it and restarts the engine with it. When it is done the panel says how many rules are enabled — on the lab router, about 46,000 of 68,000.

Then turn on Update the rules automatically, choose Every day at 03:00 or Every Sunday at 03:00, and Save schedule. The router runs the same update on that schedule from then on; apply the change to start it.

When the rules cannot be fetched — no internet, no DNS — the panel says why, in the updater's own words, and the engine keeps the rules it had.

Check it worked#

The page showsMeaning
Engine: RunningThe engine process is up.
Rules with a count and a timeThe rules were fetched, and when.
AlertsWhat the engine has matched, parsed from its alert log.

Configuration without a running engine means it did not start, and the Logs page, filtered on suricata, will say why.

To see an alert on purpose, fetch a page the standard rules flag as a test — for example, from a device on the inspected network:

bash
curl -s http://testmynids.org/uid/index.html

An alert classified Potentially Bad Traffic appears in the table within seconds.

What to do with an alert#

An IDS alert is an observation, not a verdict. Before acting:

  1. Read the signature. The message and its classification say what the rule thought it saw.
  2. Check the direction. An alert about traffic leaving a client is a different problem from one about traffic arriving.
  3. Find the host. The source address plus the Sessions page tells you what that host is doing now, and the DHCP lease table tells you which machine it is.
  4. Then decide. Blocking is a firewall rule you write — A default-drop ruleset — or, if you want the engine itself to block, inline prevention.

Undoing it#

Turn off intrusion detection on the IDS page asks twice, then removes the service and its scheduled rule update. Uninstalling the feature from the Apps page while it is configured puts the same removal in the pending changes rather than doing it silently.

See also#

Updated 2026-09-17 ids suricata security

Edit this page