Suricata becomes an intrusion prevention system (IPS) on Ubuntu only when traffic is placed in an inline path and the engine is allowed to drop or reject packets. Installing the package and loading signatures creates an intrusion detection system (IDS), but it does not block anything. For most Ubuntu routers and firewalls, NFQUEUE is the most practical design: firewall rules send selected traffic to a queue, Suricata evaluates it, and verdicts return to the firewall. AF_PACKET IPS is better when the Ubuntu host is a transparent device between two network segments and has two dedicated interfaces.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide installs the stable Ubuntu build, loads rules, validates the engine, configures both inline choices, verifies packet processing and prevention, and gives you a rollback plan before you put production traffic at risk.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What you need before enabling IPS
Plan the traffic path before editing Suricata. NFQUEUE works at Layer 3 and integrates with the host’s IPv4/IPv6 firewall and routing policy. AF_PACKET IPS works at Layer 2 and copies frames between two interfaces, so it is intended for a transparent inline appliance rather than a normal single-interface server.
- An Ubuntu host with administrative access and a maintenance window.
- A clear list of interfaces, routes, and traffic that must be inspected.
- A console or out-of-band way back into the host. A queue rule can interrupt SSH if Suricata is stopped while packets are still being queued.
- For AF_PACKET, two interfaces that can be dedicated to the two sides of the inline link. They may be built-in NICs or adapters, but driver support, USB-bus capacity, and expected traffic rate must be checked before relying on a USB adapter.
- A controlled, authorized test flow or test signature. Do not use an unknown exploit payload to test a production network.
Install Suricata and identify the build
The Open Information Security Foundation (OISF) quickstart uses the stable Ubuntu PPA. Install the package and jq (useful for reading EVE JSON) exactly as follows:
#1 Best Overall
- 𝐇𝐢𝐠𝐡-𝐒𝐩𝐞𝐞𝐝 𝐔𝐒𝐁 𝐄𝐭𝐡𝐞𝐫𝐧𝐞𝐭 𝐀𝐝𝐚𝐩𝐭𝐞𝐫 - UE306 is a USB 3.0 Type-A to RJ45 Ethernet adapter that adds a reliable wired network port to your laptop, tablet, or Ultrabook. It delivers fast and stable 10/100/1000 Mbps wired connections to your computer or tablet via a router or network switch, making it ideal for file transfers, HD video streaming, online gaming, and video conferencing.
- 𝐔𝐒𝐁 𝟑.𝟎 𝐟𝐨𝐫 𝐅𝐚𝐬𝐭𝐞𝐫, 𝐌𝐨𝐫𝐞 𝐒𝐭𝐚𝐛𝐥𝐞 𝐃𝐚𝐭𝐚 𝐓𝐫𝐚𝐧𝐬𝐟𝐞𝐫𝐬- Powered via USB 3.0, this adapter provides high-speed Gigabit Ethernet without the need for external power(10/100/1000Mbps). Backward compatible with USB 2.0/1.1, it ensures reliable performance across a wide range of devices.
- 𝐒𝐮𝐩𝐩𝐨𝐫𝐭𝐬 𝐍𝐢𝐧𝐭𝐞𝐧𝐝𝐨 𝐒𝐰𝐢𝐭𝐜𝐡- Easily connect your Nintendo Switch to a wired network for faster downloads and a more stable online gaming experience compared to Wi-Fi.
- 𝐏𝐥𝐮𝐠 𝐚𝐧𝐝 𝐏𝐥𝐚𝐲- No driver required for Nintendo Switch, Windows 11/10/8.1/8, and Linux. Simply connect and enjoy instant wired internet access without complicated setup.
- 𝐁𝐫𝐨𝐚𝐝 𝐃𝐞𝐯𝐢𝐜𝐞 𝐂𝐨𝐦𝐩𝐚𝐭𝐢𝐛𝐢𝐥𝐢𝐭𝐲- Supports Nintendo Switch, PCs, laptops, Ultrabooks, tablets, and other USB-powered web devices; works with network equipment including modems, routers, and switches.
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt update
sudo apt install suricata jqInspect the installed version and service before changing the inline design:
suricata --build-info
suricata --version
sudo systemctl status suricata --no-pager--build-info is especially important for NFQUEUE: the output must show NFQ support. If NFQ is absent, an iptables or nftables queue rule can exist without Suricata being able to consume it.
Recommended Free Tools
Load and understand the rule set
Suricata signatures are commonly called rules. The official management utility is suricata-update. Run it before starting inline inspection:
sudo suricata-updateThe quickstart places the resulting rules under /var/lib/suricata/rules and uses suricata.rules by default. Confirm that the file exists and that your configuration points to the intended rule directory:
sudo ls -lh /var/lib/suricata/rules/suricata.rules
grep -n "default-rule-path|rule-files" /etc/suricata/suricata.yamlRules can alert, drop, or reject depending on their action and the run mode. Merely downloading rules does not turn on prevention; the inline mode and firewall path must also be correct.
Rank #2
- Connects a USB 3.0 device (computer/laptop) to a router, modem, or network switch to deliver Gigabit Ethernet to your network connection. Does not support Smart TV or gaming consoles (e.g.Nintendo Switch).
- Supported features include Wake-on-LAN function, Green Ethernet & IEEE 802.3az-2010 (Energy Efficient Ethernet)
- Supports IPv4/IPv6 pack Checksum Offload Engine (COE) to reduce Cental Processing Unit (CPU) loading
- Compatible with Windows 8.1 or higher, Mac OS
Validate YAML and capabilities before touching live traffic
Always test the complete configuration first. The -T option parses the YAML and initializes enough of the engine to find syntax and capability errors:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo suricata -T -c /etc/suricata/suricata.yamlDo not proceed until the command finishes successfully. A failed test usually means a YAML indentation error, an invalid interface name, an unavailable output, or a rule/configuration mismatch.
For NFQUEUE, confirm the build feature separately:
suricata --build-info | grep -i nfqThe exact formatting varies by package, but NFQ must be listed. Also check that the kernel firewall tools you intend to use are installed and that the queue number in those tools will match Suricata’s -q argument.
Choose NFQUEUE or AF_PACKET IPS
| Decision point | NFQUEUE | AF_PACKET IPS |
|---|---|---|
| Placement | Layer 3, integrated with the Ubuntu firewall and routing path | Layer 2, transparent inline path between two interfaces |
| Interfaces | One or more existing routed interfaces; no second NIC inherently required | Two dedicated interfaces, one facing each network segment |
| Traffic selection | Very narrow selection is possible with INPUT, OUTPUT, FORWARD, address, protocol, port, and queue rules | Traffic crossing the paired interfaces is copied by Suricata |
| Firewall dependency | Requires matching iptables NFQUEUE or nftables queue rules | Does not require forwarding queue rules; Suricata copies packets between ports |
| Failure and rollback | Remove queue rules before stopping Suricata, or queued packets can interrupt connectivity | Restore the original cabling or bypass path and disable the paired interfaces/configuration |
| Best fit | An Ubuntu router, gateway, or host that already owns firewall policy | A dedicated transparent sensor between two physical network segments |
Choose NFQUEUE when Ubuntu already routes the traffic and you need policy-level selection. Choose AF_PACKET when the host is physically in the path and two interfaces can be reserved for inspection.
Configure NFQUEUE inline IPS
1. Start Suricata on the selected queue
Queue number 0 is only an example; it must match the firewall rule:
Rank #3
- Ultra-Fast, Rock-Solid: The UGREEN usb to ethernet adapter is engineered for ultra-fast 1000Mbps network speeds. It delivers rock-solid stability and security, helping you boost productivity, unleash smooth gameplay, and browse seamlessly
- Seamless Compatibility with Nintendo Switch: The ethernet to usb adapter is fully compatible with Nintendo Switch and Switch OLED, just connect it to the dock’s ethernet port and dive into ultra-smooth, lag-free gaming
- Plug and Play: The ethernet adapter is driver-free for Windows 11/10/8.1/8, macOS, Chrome OS, and Android. It requires installing the driver on Windows XP/7/Vista and Linux, which you can easily install with our instructions
- Wide Compatibility: The usb to ethernet is compatible with most laptops and desktops featuring USB 3.0 ports, including MacBook Air/Pro, Dell XPS, Surface Book, and more
- Crafted to Last, Designed to Impress: Built with a sturdy aluminum shell for efficient heat dissipation and enhanced durability, the ethernet to usb is designed to last. The cable connection point features reinforced construction for extra strength and reliability. A yellow-green LED indicator keeps you instantly informed of its working status
sudo suricata -c /etc/suricata/suricata.yaml -q 0For a service-managed installation, put the equivalent queue option in the service’s Suricata startup configuration rather than launching a second copy. Check the active unit and distribution-specific service file before editing it:
systemctl cat suricata
sudo systemctl restart suricataNever run two Suricata instances against the same queue unless you have deliberately designed that arrangement.
2. Add narrowly scoped firewall queue rules
Send only the path you intend to inspect. For a routed gateway, that is often FORWARD; INPUT and OUTPUT apply to traffic terminating on or originating from the Ubuntu host. The following examples show the syntax pattern and queue 0; replace the interface, address, and protocol criteria with values from your own policy:
sudo iptables -I FORWARD -i <inside-interface> -o <outside-interface> -j NFQUEUE --queue-num 0
sudo iptables -I FORWARD -i <outside-interface> -o <inside-interface> -j NFQUEUE --queue-num 0For host traffic, use equivalent rules in INPUT or OUTPUT. Include IPv6 with ip6tables if IPv6 is enabled; an IPv4-only queue leaves IPv6 outside the IPS path. With nftables, use a queue statement in the appropriate input, output, or forward chain and set its queue number to 0. Keep an administrative bypass or console path available while testing.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Understand the stop order
Stopping Suricata first while queue rules remain active can leave packets waiting in NFQUEUE and interrupt connectivity. The safe rollback sequence is:
Rank #4
- Exploring the New Era of 2.5Gb: The UGREEN usb to ethernet adapter supports a internet speed of up to 2.5Gb and enables your devices to run at full speed. Enjoy unbelievably fast downloads with NAS, fluent streaming, immersive gaming
- Faster, Smoother, Cooler Realtek Chip: The ethernet to usb is equipped with an updated RTL8156BG chip, ensure the network always at peak run. When running 2.5Gb at full speed, it consumes low power, reduce heat dissipation and provide stable performance
- Flexibiliy Upgrade 1Gb to 2.5Gb: Immediately upgrade your 1Gb network, just pair it with 2.5Gb-capable devices like switches and routers to give your aged devices new life! This flexibility is an advantage for you transitioning to higher-speed network
- Instantly Add a 2.5Gb Ethernet Connection: Designed for modern USB laptops that no longer include an Ethernet port. Get fast, stable wired internet whenever Wi-Fi or Gigabit isn't enough
- Sleek, Strong, Stunning: The ethernet adapter for laptop adopts high-quality aluminum. The ports are resistant to plugging and unplugging and the reinforced design makes it very durable for use. Indicator lights make transmission status clear at a glance
- Remove or disable the rules that send traffic to NFQUEUE.
- Confirm that normal forwarding or host traffic works without the queue.
- Stop or restart Suricata.
- Restore the queue rules only after the service is healthy and the configuration test passes.
Persist firewall rules only after the temporary test has succeeded and you have recorded a recovery command or console procedure.
Configure AF_PACKET inline IPS
AF_PACKET IPS requires two dedicated interfaces. In /etc/suricata/suricata.yaml, configure the af-packet section with IPS copy mode and point each interface at the other port. The interface names below are examples:
af-packet:
- interface: eth1
copy-mode: ips
copy-iface: eth2
- interface: eth2
copy-mode: ips
copy-iface: eth1Both interfaces must be up, and the cable or switch topology must place them on opposite sides of the protected segment. In this mode Suricata handles copying between interfaces, so you do not add iptables or nftables forwarding queue rules merely to bridge the traffic. Avoid assigning ordinary host services or management addresses to the inline ports unless your design explicitly requires it; keep management reachable through a separate path.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11AF_PACKET is not a replacement for a routed firewall. It is a transparent forwarding arrangement, and routing, VLAN, bonding, offload, and link-failure behavior must be tested with the actual switch and NICs. A single-interface Ubuntu host cannot provide this two-port design without an additional interface.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Start the service and verify that packets are inspected
After changing YAML, rules, or service options, validate again and restart:
Best Value
![BENFEI USB 3.0 to Ethernet Adapter, USB C to RJ45 Gigabit LAN (1000Mbps) Network Adapter, Compatible with MacBook/Pro/Air, Surface Pro, Windows 11/10/8/7, Mac OS [Aluminium Shell&Nylon Cable]](https://m.media-amazon.com/images/I/41fk9DHmdwL._SL160_.jpg)
- COMPACT DESIGN - The compact-designed portable BENFEI USB A/C to Ethernet adapter connects your computer or tablet to a router,modem or network switch for network connection. It adds a standard RJ45 port to your Ultrabook, notebook or Macbook Air for file transferring, video conferencing, gaming, and HD video streaming.
- SUPERIOR STABILITY - Built-in advanced IC chip works as the bridge between RJ45 Ethernet cable and your USB A/C devices. The driver-free installation with native driver support in Chrome, Mac, and Windows OS; The USB A/C Ethernet adapter dongle supports important performance features including Wake-on-Lan (WoL), Full-Duplex (FDX) and Half-Duplex (HDX) Ethernet, Crossover Detection, Backpressure Routing, Auto-Correction (Auto MDIX).
- INCREDIBLE PERFORMANCE - Supports full 10/100/1000Mbps gigabit ethernet performance over USB A/C's 5Gbps bus, faster and more reliable than most wireless connections. Link and Activity LEDs. USB powered, no external power required. Backward compatible with USB 2.0/1.1.✅ To reach 1Gbps, make sure to use CAT6 & up Ethernet cables.
- BROAD COMPATIBILITY - The USB A/C-Ethernet adapter is compatible with Windows 11/10/8.1/8/7/Vista/XP, Mac OSX 10.6/10.7/10.8/10.9/10.10/10.11/10.12, Linux kernel 3.x/2.6, Android and Chrome OS.Compatible with IEEE 802.3, IEEE 802.3u and IEEE 802.3ab. Supports IEEE 802.3az (Energy Efficient Ethernet).❌Do Not Support Windows RT. (NOT compatible with Nintendo Switch.)
- 18 MONTH WARRANTY - Exclusive BENFEI Unconditional 18-month Warranty ensures long-time satisfaction of your purchase; Friendly and easy-to-reach customer service to solve your problems timely.
sudo suricata -T -c /etc/suricata/suricata.yaml
sudo systemctl restart suricata
sudo systemctl status suricata --no-pagerRead the engine log immediately:
sudo tail -f /var/log/suricata/suricata.logThe quickstart’s successful startup ends with messages that packet-processing and management threads have initialized and the engine has started. An initialization message alone does not prove that traffic is arriving, so inspect counters while generating ordinary authorized traffic:
sudo tail -f /var/log/suricata/stats.logPacket and decoder counters should increase when traffic crosses the selected NFQUEUE path or AF_PACKET pair. If counters remain flat, check the physical path, interface names, queue number, firewall chain, and whether the test traffic actually traverses that path.
Alerts and actions normally appear in EVE JSON. Use jq to inspect readable events:
sudo tail -f /var/log/suricata/eve.json | jqLook for alert events and the associated action or drop/reject information. Verify timestamps, interface or flow details, and the signature identifier so you know the event belongs to your controlled test rather than unrelated background traffic.
Prove prevention without risking the network
A valid IPS test has three parts: a known trigger, an expected verdict, and a recovery test. Schedule it in a maintenance window and obtain authorization from the network owner. The cited OISF material documents operation and logging but does not define one universal safe payload or performance benchmark, so select a test signature or controlled flow appropriate to your environment.
- Record the current firewall rules, interface state, routes, Suricata configuration, and service status.
- Enable only the intended queue or AF_PACKET path.
- Generate the authorized test traffic from a controlled host.
- Confirm an alert in EVE output and verify that the configured action actually drops or rejects the flow, rather than merely logging it.
- Confirm that unrelated permitted traffic still works.
- Remove the queue rules (NFQUEUE) or bypass the inline link (AF_PACKET), restart or stop Suricata, and verify the documented rollback path.
- Re-enable prevention only after the rollback and a second configuration test succeed.
Do not infer throughput, latency, or maximum connection rates from a successful functional test. No universal numeric performance result is established here; capacity depends on hardware, rule count, traffic mix, capture mode, and configuration.
Troubleshoot common failures
Suricata starts, but nothing is blocked
- Confirm you selected an inline mode. A normal interface capture or IDS launch only alerts.
- For NFQUEUE, verify that the firewall rule is in the chain traffic actually traverses and that its queue number matches
-q 0. - For AF_PACKET, verify both interfaces use
copy-mode: ips, eachcopy-ifacepoints to the opposite port, and the cables are on opposite sides of the path. - Check that the loaded rule’s action is suitable for prevention and that the event shows a drop or reject, not just an alert.
The configuration test fails
- Run
sudo suricata -T -c /etc/suricata/suricata.yamlagain and read the first reported YAML or rule error. - Check indentation, interface spelling, file permissions, and the existence of
/var/lib/suricata/rules/suricata.rules. - After changing rule files, run
sudo suricata-updateand retest.
NFQUEUE breaks connectivity
- Use the console or out-of-band path to remove the INPUT, OUTPUT, or FORWARD queue rules.
- Check whether Suricata is running and whether NFQ appears in
suricata --build-info. - Look for a queue-number mismatch or a second firewall rule that sends traffic to a queue with no consumer.
- Restore the last known-good firewall policy before investigating performance or rule tuning.
AF_PACKET forwards one direction only
- Confirm both interfaces are up and each has the other interface as
copy-iface. - Check link LEDs, switch VLAN placement, NIC driver messages, and whether another bridge, bond, or network manager profile is altering the path.
- Temporarily bypass the inline host to distinguish a Suricata configuration problem from cabling or switch configuration.
Operational maintenance
Run suricata-update on a schedule appropriate to your change-control process, then test the configuration before restarting the service. Review EVE alerts and drops, stats.log counters, and suricata.log for initialization or decoder errors. Keep a versioned copy of /etc/suricata/suricata.yaml, the selected rule sources, firewall queue rules, interface mapping, and the exact rollback commands.
When changing from NFQUEUE to AF_PACKET or back, remove the old traffic path first, validate the new configuration with -T, and perform a controlled prevention test. Treat IPv4 and IPv6 as separate enforcement paths: adding an IPv4 queue rule does not automatically inspect IPv6.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
