# How to use suricata-update on airgapped system?

**URL:** <https://forum.suricata.io/t/how-to-use-suricata-update-on-airgapped-system/1105>\
**Category:** Rules\
**Created:** [February 16, 2021, 5:52pm UTC](https://forum.suricata.io/t/how-to-use-suricata-update-on-airgapped-system/1105 "2021-02-16T17:52:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![charles.huddleston](https://avatars.discourse-cdn.com/v4/letter/c/71e660/32.png) [@charles.huddleston](https://forum.suricata.io/u/charles.huddleston)\
**Post date:** [February 16, 2021, 5:52pm UTC](https://forum.suricata.io/t/how-to-use-suricata-update-on-airgapped-system/1105/1 "2021-02-16T17:52:29Z")

</div>

I would like to take advantage of the suricata.rules that is generated with suricata-update on an internet connected machine and transfer it to an airgapped machine.

What is the best approach to accomplish this? I’m thinking using the ruleset created through suricata-update as a local.rules.

Any suggestions?

Thanks!

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [February 16, 2021, 8:11pm UTC](https://forum.suricata.io/t/how-to-use-suricata-update-on-airgapped-system/1105/2 "2021-02-16T20:11:42Z")

</div>

How would you transfer the file in general? You are quite flexible with the generated file and either rsync it, make it available via https etc.

---

<div class="post-metadata">

**Author:** ![charles.huddleston](https://avatars.discourse-cdn.com/v4/letter/c/71e660/32.png) [@charles.huddleston](https://forum.suricata.io/u/charles.huddleston)\
**Post date:** [February 16, 2021, 8:21pm UTC](https://forum.suricata.io/t/how-to-use-suricata-update-on-airgapped-system/1105/3 "2021-02-16T20:21:42Z")

</div>

Moving the suricata.rules to the new system isn’t the issue, I just have to use a removable media device. Let me refine the question.

Beyond putting the new file in /var/suricata/rules/ and doing a systemctl reload suricata , is there anything else I need to do?

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [February 16, 2021, 8:29pm UTC](https://forum.suricata.io/t/how-to-use-suricata-update-on-airgapped-system/1105/4 "2021-02-16T20:29:41Z")

</div>

> [@charles.huddleston](#):
>
> Beyond putting the new file in /var/suricata/rules/ and doing a systemctl reload suricata , is there anything else I need to do?

No, there shouldn’t be. Just make sure that is where the Suricata on the airgapped system is looking for rules.

---

<div class="post-metadata">

**Author:** ![charles.huddleston](https://avatars.discourse-cdn.com/v4/letter/c/71e660/32.png) [@charles.huddleston](https://forum.suricata.io/u/charles.huddleston)\
**Post date:** [February 16, 2021, 8:35pm UTC](https://forum.suricata.io/t/how-to-use-suricata-update-on-airgapped-system/1105/5 "2021-02-16T20:35:39Z")

</div>

Perfect, thank you for the response Jason!

---

<div class="post-metadata">

**Author:** ![yogeshdp](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yogeshdp/32/693_2.png) [@yogeshdp](https://forum.suricata.io/u/yogeshdp)\
**Post date:** [February 26, 2021, 3:32am UTC](https://forum.suricata.io/t/how-to-use-suricata-update-on-airgapped-system/1105/6 "2021-02-26T03:32:28Z")

</div>

I have similar setup, just that system is accessible through internal network but cannot access internet and i have to push rules from the suricata server having internet access, what is the best way here  
@ish please comment