IDS#

Protect → IDS runs the intrusion detection engine the router ships with, Suricata. It inspects the traffic on the interfaces you choose, compares it with its rules and records what matches as alerts. Turning it on, the interfaces, the home networks and the groups its rules refer to are all configuration, added to the pending changes and applied like anything else.

Detection watches a copy of the traffic. It raises alerts and cannot block a connection; the Firewall remains the only thing between a flagged connection and its destination. Putting the engine in the path of the traffic is inline prevention, at the bottom of the same page.

Getting to the page#

The IDS entry appears when the Suricata IDS feature is installed from Apps, or when the router already runs the engine — a router's configuration is never hidden.

Turning it on#

With intrusion detection off, the page asks for two things:

Field	What it does
Interfaces to inspect	Chosen from the router's interfaces, VLANs included. The inside interface sees which device each connection belongs to; the uplink sees traffic before it is translated.
Home networks	The networks the rules treat as yours; everything else is outside. Suggested from the inside interface's address.

Turn on intrusion detection adds the service with those settings, the outside defined as everything that is not home, and the port groups the standard rules refer to by name (web, SSH, Oracle and shellcode ports). The engine starts when the change is applied.

Once it is on#

Four tiles across the top:

Tile	What it says
Engine	Running or Stopped, from the router's process table.
Interfaces	How many interfaces are inspected, and which.
Rules	How many rules are enabled, and when they were fetched — or None when they never have been, which is an engine that matches nothing.
Alerts	How many alerts the page holds; the last 200 are kept.

When the configuration has the engine and no engine is running, a note under the tiles says so; the Logs page, filtered on suricata, says why.

Settings#

Interfaces to inspect and Home networks as above. Save settings adds the changes. The last interface cannot be removed — the router refuses an engine with none — and neither can the last home network, which is how the rules tell inside from outside. Turn off intrusion detection removes the engine instead, asking twice, and takes the scheduled rule update with it.

Rules#

The rules are what the engine matches traffic against: a free set, fetched from the internet and refreshed as new threats are published.

Update rules now fetches the current rules, checks them and restarts the engine with them. It takes seconds to a minute, and afterwards the panel says how many rules are enabled and how many changed. When the rules cannot be fetched — no internet, no DNS — the panel says why, in the updater's own words, and the engine keeps the rules it had. It needs the operator role, is recorded in the audit log, and is available only when Wheelhouse runs on the router itself.
Update the rules automatically schedules the same update every day at 03:00 or every Sunday at 03:00, as a scheduled task on the router, and Save schedule adds it to the pending changes. A schedule set up some other way is shown as Custom and left as it is until you choose another.

This platform's configuration does not choose rule sources or categories: the updater fetches its standard free set.

Address groups and port groups#

The rules refer to networks and ports by group name — the home and outside networks, web ports, SSH ports — so these groups decide what the rules mean on this router. Both tables list each group with its members and the groups it includes; Add address group and Add port group add one, and clicking a group opens it.

Field	What it does
Name	Lower-case letters, digits and hyphens, as the rules name them.
Addresses / Ports	Addresses or networks; ports or ranges. Starting a value with `!` excludes it.
Includes	Other groups of the same kind, each either included or, as Everything except, excluded. A group cannot include itself, directly or through another.

A group another group includes cannot be deleted, and neither can the last group of its kind: the router refuses an engine without an address group and a port group.

The alerts#

The table lists the alerts the engine writes to its event log on the router, eve.json, and is filtered with the box above it:

Column	What it shows
Time	When the engine recorded it.
Priority	1 in red, 2 in amber, anything else neutral.
Signature	What the rule saw.
Classification	The rule's category.
Flow	Source and destination, with ports where the protocol has them. An alert about a packet the engine could not decode names neither.
SID	The rule's identifier.

The last 200 alerts are kept. The router starts a new event log every week, or sooner when it grows large, and the table then lists only the alerts since. When the log cannot be read, the panel says so instead of showing an empty table. Alerts are read on the router itself; when Wheelhouse runs elsewhere the panel says so, and everything else on the page still works.

What the IDS does not do#

It does not block anything. Inline prevention is the arrangement that can.
It does not tune the engine. Beyond the interfaces, home networks and groups, the engine runs with the platform's settings.
It does not silence a signature. There is no per-signature suppression on the page.