I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this:

[Router] <----> [ IPS ] <-------> [ Honeypot ]

My problem is that most of the IPS rule sets out there are designed to drop/alert known malicious traffic.

My objective is to let all the traffic in, and have a drop by default policy for outgoing connections.

Over the drop by default policy, I would like specific rules to allow specific things such as SSH response, HTTP response, Wget , APT (for honeypot updates and so attackers can actually download and test malware on the honeypot).

The general idea is to let all attacks in, and block all malicious outbound traffic that may harm other servers. Sort of a positive security vs a negative security approach.

Does anyone know how I could start a set of rules that would best fit this scenario, or better still, recommend a better policy for my IPS?

2 Answers 2


Alternatively, you can simply capture all traffic as pcap and run snort rules in offline mode for research/investigation.


due to the direction - nature of snort-sigs (src -> dst) you'll need 2 different installs, one protecting the incoming stream, one connecting the outgoing stream, if you want to snortify not only incoming, but also outgoing connections. even better, have for every direction one NIC.

2nd: suricata is an IDS and can be made an IPS, maybe you should try to understand the difference and what you need to do (or not) to make your IDS an IPS.

for blocking outgoing-stuff iptables would be more sufficient, just block (but log) anything out except port 22/80/443 and maybe irc-ports.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .