Inline prevention#
Intrusion detection watches a copy of the traffic and cannot block it. Inline prevention puts the engine in the path: a firewall rule hands the traffic it matches to the engine, the engine decides on each packet, and what it passes carries on. The Inline prevention panel at the bottom of the IDS page says whether that is in place, builds the change that puts it there, and takes it out again. All of it is configuration — an engine and a firewall rule — added to the pending changes and applied like anything else.
What the panel says#
| Beside the title | Meaning |
|---|---|
| Detection only | Nothing sends traffic to an engine. |
| Blocking | The engine is in place, a rule sends traffic to it, and it is running. |
| Engine stopped | The same, with the engine not running. |
When it is in place, the panel lists the engine's state and every rule that sends it traffic.
If the engine stops#
Two settings keep traffic flowing when the engine is not there to decide:
- The firewall rule lets traffic pass when nothing is reading from it. A rule without that fallback blocks all its traffic while the engine is down; the panel names any such rule, and Let traffic pass if the engine stops adds the fallback.
- The engine itself passes traffic it cannot decide on.
Between them, a stopped or crashed engine passes traffic rather than blocking it.
The two ways in#
Turn on inline prevention opens a choice of what to inspect.
Traffic an accept rule allows#
The list offers every Forward rule whose action is Accept. The chosen rule sends the traffic it already admits through the engine: the same connections, now inspected, and nothing new allowed. This is the safe choice.
Everything arriving on an interface#
A new Forward rule sends every connection arriving on the chosen interface to the engine. Until rules are loaded the engine passes everything, so this admits all the interface's traffic until then — the panel says so before anything is added.
In both cases the panel shows what the change will do under Before you apply, and Turn on inline prevention adds it to the pending changes: the engine, declared once, and the rule.
Taking it out#
Turn off inline prevention asks twice, then removes the engine and turns each rule that sent it traffic back into a plain Accept rule — what a converted rule was before, and a harmless form for a rule the panel added, which can then be deleted on the Firewall page. Read the pending changes before applying: a rule that becomes Accept admits traffic that was, a moment ago, being inspected.
Limits#
- IPv4 only. The rules are Forward rules of the IPv4 family.
- The state is read from the configuration. Blocking means a rule sends traffic to a declared, running engine; whether the engine has rules loaded is the IDS page's Rules tile.
- Alerts are the IDS page's alert table.
See also#
- IDS — detection, its settings, its rules and its alerts.
- Firewall — rules — the chain the rule lives in.
- Worked rulesets — the accept rules that are the safe choice.
- Apps — installing the engine before you apply.
- Commit-confirm — use it for this change.