IDS versus IPS — detection, prevention, and where the firewall fits in between

A stateful firewall decides what traffic is allowed. An intrusion detection system (IDS) decides what traffic looks malicious. An intrusion prevention system (IPS) decides what traffic to block because it looks malicious. The three are related but distinct, and a firewall operator who treats them as interchangeable ends up with either a noisy detection surface (an IDS that nobody acts on) or a brittle block surface (an IPS that drops legitimate traffic). This lesson covers what IDS and IPS actually do, how they differ from a stateful firewall, the cost of each on a production firewall, and the deployment shapes where one or the other is the right answer.

What a stateful firewall is, and is not

A stateful firewall — the kind OPNsense runs — decides what traffic is permitted based on the rules the operator has configured. The decision is binary: pass or block. The decision is based on the protocol, the source, the destination, the port, and the state table. The firewall does not care whether the traffic that passes through it is malicious — only whether the rules allow it.

This is the firewall’s job, and the firewall does it well. The stateful model has limitations:

• A stateful firewall cannot detect malware in allowed traffic. If the operator has a rule that permits HTTP to the Internet, the firewall permits HTTP. If the HTTP carries an exploit, the firewall does not know.
• A stateful firewall cannot detect application-layer attacks. A SQL injection in an allowed HTTP request passes through the firewall because the firewall does not parse the SQL.
• A stateful firewall cannot detect reconnaissance. A slow port scan that does not trigger the PF state limits passes through because each connection is a valid state.

The IDS and IPS are designed to detect and (for IPS) block these categories of traffic.

What an IDS does

An IDS (Intrusion Detection System) inspects a copy of the traffic and reports what it finds. The IDS does not sit in the forwarding path — the traffic passes through the network regardless of what the IDS reports. The IDS produces alerts.

       +-------+    +-------+    +-------+
       | Host  |--->|  IDS  |--->| Alert |
       +-------+    +-------+    +-------+
              ^          ^
              |          |
              |   copy of traffic
              +----------+

The IDS has two common detection models:

• Signature-based — the IDS has a database of patterns (signatures) that match known-bad traffic. Examples: a specific HTTP request that matches an exploit, a DNS query that matches a known-malware C2 pattern, a TLS SNI that matches a known phishing domain. The signature database is updated regularly (Emerging Threats, Proofpoint, vendor feeds).
• Anomaly-based — the IDS builds a model of “normal” traffic and reports deviations. Examples: a host that suddenly sends traffic to a new country, a service that suddenly accepts many more connections than usual. Anomaly detection is harder to tune and produces more false positives; it is typically layered on top of signature detection.

The production IDS on a firewall is typically signature-based. Suricata, the IDS OPNsense bundles, is signature-based with optional anomaly detection.

What an IPS does

An IPS (Intrusion Prevention System) sits in the forwarding path and blocks traffic that matches its signatures. The IPS combines detection (the IDS part) with action (block or drop). The trade-off: the IPS can stop a known-bad packet, but a false positive blocks legitimate traffic.

       +-------+    +-------+
       | Host  |--->|  IPS  |---> (forward or drop)
       +-------+    +-------+
              ^          
              |          
              | inline in path
              +----------+

The cost of an IPS is much higher than an IDS. The IDS inspects a copy of the traffic; the IPS must inspect every packet in real time and decide whether to forward it. A signature that is computationally expensive (deep payload inspection, multi-pattern matching) becomes a forwarding bottleneck. An IPS deployment that has not been tuned for throughput produces a slower network than a deployment without the IPS.

The cost on a production firewall

Both IDS and IPS consume CPU on the firewall. The cost depends on:

• Throughput — the firewall must inspect every packet in real time (IPS) or every copy (IDS). 1 Gbps of traffic requires 1 Gbps of inspection. Suricata’s published throughput is significantly less than the line rate of the NIC; the operator must size the firewall for the actual inspection throughput, not the NIC throughput.
• Number of signatures — a signature set with 30,000 rules is more expensive to evaluate than a set with 5,000 rules. The cost is roughly proportional.
• Pattern complexity — some signatures are simple string lookups; some require multi-pattern matching or payload reassembly. The latter are more expensive.
• State tracking — Suricata tracks connection state to evaluate signatures in the context of the flow. Stateful tracking has memory cost.

A small firewall (1 CPU core, 4 GB RAM) cannot run Suricata in IPS mode on a 1 Gbps link; a larger firewall (multi-core, 16 GB RAM) can. The operator sizes for the actual workload, not the theoretical maximum.

Where each is right

The line moves with operational capability, not technology. A network that has no one to read the alerts should not run an IPS — the false positives will block legitimate traffic and the operator will turn the IPS off. A network that has a security team can run IPS because the team will tune it.

Summary

• A stateful firewall decides what traffic is allowed. An IDS detects what looks malicious. An IPS blocks what looks malicious.
• IDS inspects a copy; IPS sits inline.
• Signature-based detection matches known patterns; anomaly-based detects deviations from a model.
• An IDS without action is a deployment that consumes resources without producing benefit. An IPS without tuning blocks legitimate traffic.
• The right answer depends on operational capability, not technology. A network with security operations can run IPS; a network without should not.