I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this:
[Router] <----> [ IPS ] <-------> [ Honeypot ]
My problem is that most of the IPS rule sets out there are designed to drop/alert known malicious traffic.
My objective is to let all the traffic in, and have a drop by default policy for outgoing connections.
Over the drop by default policy, I would like specific rules to allow specific things such as SSH response, HTTP response, Wget , APT (for honeypot updates and so attackers can actually download and test malware on the honeypot).
The general idea is to let all attacks in, and block all malicious outbound traffic that may harm other servers. Sort of a positive security vs a negative security approach.
Does anyone know how I could start a set of rules that would best fit this scenario, or better still, recommend a better policy for my IPS?