The difference in one table
| IDS (detect) | IPS (prevent) | |
|---|---|---|
| Position | Passive: inspects copies of packets | Inline: traffic passes through inspection between a pair of interfaces |
| On a match | Raises an alert | Drops the traffic (drop rules) and raises an event |
| Effect on traffic | Never delays or drops traffic | Adds inspection to the path; a stopped engine stops the traffic on that pair unless fail-open is on |
| Typical use | Visibility, tuning rules, monitoring a mirror port | Blocking known attacks at the network boundary |
Intrusion detection in VYREON
In IDS mode you choose the interfaces to monitor. By default VYREON inspects the traffic of the gateway itself: traffic to and from its own interfaces and the traffic it routes for your networks. If an interface is connected to a switch mirror (SPAN) port or a network TAP, you can tell VYREON to inspect everything seen on it, so the gateway also watches traffic it does not forward.
Intrusion prevention in VYREON
In IPS mode you define pairs of interfaces. Traffic that enters one side of a pair leaves the other side only after inspection, and drop rules are enforced. Inline inspection fails closed by default: if the inspection engine stops, traffic on the pair stops too, which keeps uninspected traffic out. If availability matters more on a link, you can allow it to fail open; traffic then keeps flowing uninspected until inspection recovers, and every such bypass is logged as a high-severity event.
Rules, overrides and your own signatures
- Maintained rule sets are downloaded when an administrator updates them. A rule set that fails to download or validate keeps its previous copy, and a rule update never interrupts inline traffic.
- Overrides change the action of a single signature to alert, drop or disabled without editing the rule set. Drop overrides block only in IPS mode; in IDS mode they alert.
- Custom rules are checked as you type and validated on the gateway before they are used. If the gateway rejects a rule, nothing is applied and the console names the line.
- Home networks tell the engine which addresses you protect, so rules written for inbound attacks do not fire on your own outbound traffic.
Automatic blocking of repeat attackers
Optionally, the source of a high-priority alert can be blocked for a time you choose, from one minute to 30 days. Because attackers can forge source addresses, VYREON is careful: a TCP source is blocked only for an established connection, other protocols only after repeated alerts, and your home networks, private ranges and the gateway's own essential addresses (such as its DNS servers and the peer of a high availability pair) are never blocked.
What any IDS/IPS can and cannot see
VYREON does not decrypt TLS. Inspection uses what is visible on the wire: packet headers, plain-text protocols and TLS metadata such as the server name. Application identification can name applications in events and in your policy, at some extra CPU cost.
A safe rollout
- Enter your home networks and enable the rule sets you want.
- Start in IDS mode and watch the security events for a while. Tune noisy signatures with overrides.
- Test new custom rules in IDS mode first: a faulty rule then causes an alert or a refused reload, never an outage.
- Switch to IPS mode on the interface pairs that carry the traffic you want to protect. Changing the mode or the interfaces restarts inspection; the console tells you before you confirm, so plan it for a maintenance window.
- Rule-set updates, overrides and custom rules are applied later without interrupting traffic.
Intrusion detection and prevention is a licensed feature; a configuration that is already running keeps running without a valid licence. See all firewall features and how VYREON works.