# Suricata-IDS conflicts with other security applications **URL:** \ **Category:** Help\ **Created:** [August 20, 2020, 9:40am UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525 "2020-08-20T09:40:49Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [August 20, 2020, 9:40am UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/1 "2020-08-20T09:40:49Z")
Hello, Suricata-IDS has any conflict with the Fail2ban? How can I sure? Thanks. ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [August 20, 2020, 11:22am UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/2 "2020-08-20T11:22:45Z")
Hi Jason, Suricata (in IDS mode) processes packets off a SPAN or tap port (usually). It’ll never transmit onto the network. Suricata will generate alerts if the rules it’s provided with match the packets. I’m not sure what you mean by “conflict” – could you describe your deployment scenario? ---
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [August 20, 2020, 12:59pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/3 "2020-08-20T12:59:48Z")
I installed and configure the Suricata-IDS via [https://www.tecmint.com/setup-automatic-updates-for-centos-8/](https://www.tecmint.com/setup-automatic-updates-for-centos-8/). I installed Fail2ban too and I want to know could Suricata-IDS have any conflict with Fail2ban? Make problem for each other. ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [August 20, 2020, 1:43pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/4 "2020-08-20T13:43:19Z")
My limited understanding of fail2ban is that it monitors the host’s files looking for logins. Suricata monitors a network interface and analyzes packets that are received. What’s your network topology look like? It sounds like both applications (Suricata, Fail2ban) are running on the same machine. Does fail2ban monitor network traffic or just log files on the host? ---
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [August 20, 2020, 6:43pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/5 "2020-08-20T18:43:18Z")
Yes, they are running on a same host. Fail2ban monitoring SSH log. ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [August 20, 2020, 9:33pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/6 "2020-08-20T21:33:23Z")
Unless you combine then in some way, there shouldn’t be any conflict. Both generate logs and unless you run IPS mode or use the Suricata logs to initiate any other actions it’s totally passive, so no reason to result in a conflict. ---
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [August 21, 2020, 10:55am UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/7 "2020-08-21T10:55:37Z")
I configured Suricata-IDS via [https://kifarunix.com/install-and-setup-suricata-on-centos-8/](https://kifarunix.com/install-and-setup-suricata-on-centos-8/), then which mode is enabled? ---
**Author:** ![syoc](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@syoc](https://forum.suricata.io/u/syoc)\ **Post date:** [August 21, 2020, 11:40am UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/8 "2020-08-21T11:40:17Z")
Should be IDS mode. \20 char ---
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [August 21, 2020, 3:24pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/9 "2020-08-21T15:24:07Z")
This mode doesn’t protect my server? If yes, then how can I change it to IPS mode? ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [August 22, 2020, 12:03pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/10 "2020-08-22T12:03:30Z")
Hi Jason, The details will depend on your server specifics – here’s documentation to get started: [https://suricata.readthedocs.io/en/suricata-5.0.3/setting-up-ipsinline-for-linux.html?highlight=ips](https://suricata.readthedocs.io/en/suricata-5.0.3/setting-up-ipsinline-for-linux.html?highlight=ips) ---
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [August 22, 2020, 2:10pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/11 "2020-08-22T14:10:38Z")
Thank you for your information. My server connected to the internet directly and between the server and the internet no interface exist. The tutorial use the iptables! My server using Firewalld! Any idea? ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [August 22, 2020, 10:31pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/12 "2020-08-22T22:31:16Z")
There is no tutorial for firewalld, but underneath firewalld also uses iptables/netfilter. So I would look into the firewalld documentation how to achieve the required settings for IPS mode. ---
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [August 23, 2020, 2:59am UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/13 "2020-08-23T02:59:48Z")
Can you show me a tutorial about it? ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [August 23, 2020, 12:01pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/14 "2020-08-23T12:01:28Z")
Hi Jason, You’ll have to do some research…here’s one link which compares `iptables` and `firewalld` and shows how each can be configured. [https://www.unixmen.com/iptables-vs-firewalld/](https://www.unixmen.com/iptables-vs-firewalld/) ---
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [August 23, 2020, 4:52pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/15 "2020-08-23T16:52:23Z")
I know, but the Suricata-IDS tutorial just show iptables. I don’t know how can I convert that iptables rules into the Firewalld! ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [August 23, 2020, 6:05pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/16 "2020-08-23T18:05:43Z")
Unfortunately there doesn’t seem to be much for examples on setting up NFQUEUE rules with firewalld. I’d suggest researching the firewall-cmd rich rules to see if it can be done. Or dropping firewalld and moving to iptables. I found a guide here on that: [https://prolinuxhub.com/deploy-iptables-with-nat-and-suricata-ids-on-centos-7/](https://prolinuxhub.com/deploy-iptables-with-nat-and-suricata-ids-on-centos-7/) The other option is to continue using firewalld, but execute our documented iptables commands after firewalld is loaded during the boot process. A quick test shows me it should work, but I don’t use firewalld, so can’t be 100% sure. ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [August 23, 2020, 8:52pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/17 "2020-08-23T20:52:37Z")
> [@Hack3rcon](#): > > I know, but the Suricata-IDS tutorial just show iptables. I don’t know how can I convert that iptables rules into the Firewalld! So you could try this… Create `/etc/firewalld/direct.xml` to look like: ```xml -j NFQUEUE --queue-bypass -j NFQUEUE --queue-bypass ``` Note the `--queue-bypass`. This allows packets through if Suricata is not running. If you want packets to be dropped when Suricata is not running then remove that option. After creating this file reload with `firewall-cmd --reload`. This was tested on a CentOS 8 default install with Suricata installed from EPEL. The command line was simply `suricata -q0`. ---
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [August 23, 2020, 8:57pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/18 "2020-08-23T20:57:33Z")
Why not improve Suricata-IDS documents? Most distros using Firewalld or UFW! ---
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [August 23, 2020, 8:59pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/19 "2020-08-23T20:59:56Z")
Thank you. Can you explain the xml file for me? I should run Suricata-IDS in IPS mode manually via “suricata -q0” command? ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [August 23, 2020, 9:01pm UTC](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525/20 "2020-08-23T21:01:47Z")
> [@Hack3rcon](#): > > Why not improve Suricata-IDS documents? Most distros using Firewalld or UFW! I feel like firewalld doesn’t give you as much control as many people want to have when running IPS type setups, so they often fall back to iptables. I know in my own home router I can’t accomplish what I’ve used for years with firewalld even though I’ve tried. So it will take someone to really deep dive into it and see. What I provided seems to be work, but I can’t comment on its correctness or how it interacts with the existing firewalld rules. [Next page](https://forum.suricata.io/t/suricata-ids-conflicts-with-other-security-applications/525.md?page=2)