Intrusion prevention system (IPS) vs IDS and firewall

Un intrusion prevention system (IPS) is placed in-line on the network. It inspects packets in real time, compares them with signatures and suspicious behaviour, then blocks anything that looks like an attack. An IDS only raises an alert. A firewall decides on IP address and port, not on content.

We start by placing the IPS alongside the IDS and the firewall, then list the attacks it stops. Next comes a comparison of Suricata and Snort, a step-by-step setup on pfSense or OPNsense, and finally the reason an IPS is no substitute for network-level Anti-DDoS.

In brief

• An IPS blocks malicious traffic as it happens, whereas an IDS only flags it.
• It reads the contents of packets, which a stateful firewall does not.
• Suricata is the default choice on pfSense and OPNsense.
• Start in alert mode, disable hardware offloads and size your CPU before switching to blocking.
• An IPS cannot stop a volumetric DDoS attack. That is the job of Anti-DDoS upstream.

What is an intrusion prevention system (IPS)?

NIST SP 800-94, published in 2007, uses the term IDPS (intrusion detection and prevention systems). In that framework, an IPS does everything an IDS does and also tries to stop the incident it has detected. The document has aged, but its vocabulary is still the reference. Before citing it in a compliance file, check its revision status on the NIST website.

Two detection methods coexist. The first relies on signatures: rules describing a known pattern, such as a string in an HTTP request or the exploit sequence for a CVE. The second looks for anomalies: an unusual volume of connections, a hijacked protocol, behaviour that departs from the norm. Signatures are precise but blind to anything new. Behavioural detection casts a wider net, at the cost of more false positives.

Three terms come up everywhere. A rule contains the signature and the action attached to it. A false positive is legitimate traffic mistaken for an attack. The action can be alert (log it), drop (discard the packet) or reject (discard it and notify the sender).

Worth knowing: NIPS or HIPS? A NIPS (network) monitors the traffic passing through a machine or dedicated device, such as a pfSense router. A HIPS (host) runs on the server itself and watches its files, processes and connections. This article is about the NIPS.

Inline mode: why an IPS blocks and an IDS does not

An IDS receives a copy of the traffic (a mirror port, passive mode). It sees everything but cannot stop anything: by the time the alert fires, the malicious packet has already arrived. An IPS sits in-line. All traffic passes through it, so it can reject a packet before it reaches its target.

The downside is straightforward. If the IPS fails, legitimate traffic stops too. If a rule is wrong, you block your own users. And every inspected packet costs a little latency and CPU.

IPS, IDS and firewall: what are the differences?

A stateful firewall tracks connections and decides on IP address, port and protocol. It will allow port 443 to your web server, but it cannot tell whether the request passing through contains an SQL injection. That is where the IPS takes over.

Criterion	Stateful firewall	IDS	IPS
Position	In-line	On a copy of the traffic	In-line
What is analysed	IP headers, ports, connection state	Application content and payload	Application content and payload
Action	Filter (allow or deny)	Alert	Block, alert
Main risk	Rules that are too permissive	Ignored alerts, no protection	A false positive that cuts legitimate traffic
Example tool	pf, nftables	Suricata or Snort in passive mode	Suricata or Snort in inline mode

The three complement one another, and both pfSense and OPNsense combine a firewall and an IPS on one machine. For the host-side equivalent, you can set up a UFW firewall on a Linux VPS.

Which attacks does an IPS actually block?

With an up-to-date ruleset, an IPS can stop:

• exploitation of known vulnerabilities (CVEs) on an exposed service, such as a web server or an unpatched application;
• SQL injection and XSS in unencrypted HTTP traffic;
• port scans and vulnerability scans;
• SSH or RDP brute-force attempts, using a threshold of attempts per IP (for RDP, see also how to secure RDP on a Windows VPS);
• communication with malware or botnet command-and-control (C2) servers;
• IP addresses on reputation lists;
• protocols that are not permitted on a given network segment.

Its limits are real. On TLS-encrypted traffic, the IPS only sees metadata such as the SNI or JA3 fingerprints (and JA4 in recent versions of Suricata), unless you decrypt the stream. A zero-day attack has no signature yet. As for volumetric DDoS, we come back to that below.

Suricata or Snort: which should you choose on pfSense or OPNsense?

Suricata is multi-threaded, detects application protocols automatically and produces EVE JSON logs, which are easy to feed into a monitoring tool. It is built into OPNsense (Services > Intrusion Detection) and available as a package on pfSense.

Snort is the original engine. Version 3 is multi-threaded, whereas the 2.x branch was not. It is available as a package on pfSense, but OPNsense does not offer it. Before you decide, check which branch the pfSense package installs for your release.

On rules, ET Open (Emerging Threats) is free and works with Suricata. Snort offers the Community, Registered (free on sign-up, published with a delay compared with the Subscriber set, historically 30 days) and Subscriber (paid) rulesets.

Our view: Suricata in the vast majority of cases, and the only option on OPNsense. Snort still makes sense if you already have Snort rules and habits on pfSense.

How to install Suricata on pfSense or OPNsense

On OPNsense

1. Open Services > Intrusion Detection > Administration and tick the enable box.
2. Choose the WAN interface, then the pattern matcher: Hyperscan if your processor supports it, otherwise the default.
3. In the download tab, enable the ET Open ruleset and run the rules update.
4. Leave IPS mode unticked at first. You are then running as an IDS: alerts are logged and nothing is blocked.
5. Schedule automatic rule updates, then enable IPS mode once you have reviewed the alerts.

On pfSense

1. Install the package via System > Package Manager, then open Services > Suricata.
2. Enable the ET Open download in the global settings and update the rules.
3. Add the WAN interface and choose the rule categories.
4. Stay in alert-only mode to begin with. To block, choose Inline mode (netmap) or Legacy blocking, which blocks the source IP of alerts.

Menu labels change from one version to the next, so check them against the documentation for your release.

Precautions on a KVM VPS: offloading, false positives, resources

• Disable hardware offloads (checksum, TSO, LRO) before using inline mode. The OPNsense documentation recommends this, and pfSense has the same tick boxes in its advanced networking settings.
• Test netmap with your virtio interfaces (vtnet). Support depends on the version and on driver behaviour: validate on a test instance, and fall back to pfSense's legacy mode if needed.
• Watch alerts for a week or two, then switch to drop for the rules whose alerts you trust.
• Protect your own access with a pass list containing your administration IPs. Without one, a false positive can lock you out.
• Size generously: inspection uses CPU and RAM, especially with many active rules. Guaranteed vCPUs with no over-allocation keep latency from varying with your neighbours. A Linux KVM VPS with guaranteed resources follows the same logic for the application servers behind your firewall.

Does an IPS replace network Anti-DDoS protection?

No. A volumetric attack of several Gbps saturates the link before it even reaches the IPS, which then becomes the bottleneck itself. Anti-DDoS filters upstream, on the hosting provider's network, while the IPS deals with targeted application-level threats. For more detail, read our guide to securing your VPS against DDoS attacks.

The right architecture is built in layers:

1. network Anti-DDoS, upstream;
2. a pfSense or OPNsense firewall;
3. a Suricata IPS;
4. host hardening (SSH, updates, local firewall).

The VPS pfSense & OPNsense offer, a self-hosted firewall and VPN in France, fits this model: 1 Tbps Anti-DDoS included, hosting at the Telehouse Paris datacentre, and KVM virtualisation with no over-allocation. The plans are available for pre-order, with availability announced for 1 November 2026.

Frequently asked questions

What is the difference between an IDS and an IPS?

An IDS analyses a copy of the traffic and generates alerts, with no way of intervening. An IPS sits in-line and can block malicious packets before they reach their target. The same engine, Suricata for example, can play either role depending on its mode.

Does an IPS slow the network down?

Yes, slightly: every packet is inspected, which adds latency and uses CPU. The effect depends on the number of active rules and the power available. On a well-sized instance, it stays modest.

Is Suricata free?

Yes. Suricata is open-source software, and the ET Open ruleset is free too. Paid rulesets exist, but you do not need one to get started.

Can you run Suricata and Snort together on pfSense?

Both packages exist on pfSense, but running them on the same interface doubles the load and the alerts with no real benefit. Pick one engine per interface.

Can an IPS inspect encrypted HTTPS traffic?

Not the content, unless the stream is decrypted, which needs dedicated configuration. Without that, it works from metadata such as the SNI or JA3 fingerprints. Those clues are enough to spot certain malicious tools, but not an SQL injection hidden inside an encrypted request.

Do you need an IPS on a VPS, or is a firewall enough?

A firewall is enough for lightly exposed services that are updated regularly. An IPS becomes worthwhile as soon as you expose web applications, have several machines behind one router, or want to detect C2 traffic. It complements the firewall rather than replacing it.

Where to deploy a firewall with an IPS

Start with a test instance: install Suricata in alert mode, leave it running for a week and read the logs before blocking anything. When you move to production, choose an instance with guaranteed vCPUs, placed behind network Anti-DDoS, since the IPS does not stop volumetric attacks.

That is what VPS pfSense & OPNsense, the self-hosted firewall and VPN in France, provides: 1 Tbps Anti-DDoS included at no extra cost, GDPR-compliant hosting at Telehouse Paris, and 24/7 human support. The plans are available for pre-order, with availability announced for 1 November 2026.