42. Evading IDS, Firewalls and Honeypots – Detection Games

42.8 Lab – Suricata or firewalld Logging on OWN VM

By Ravindra Bagale · Last updated: 27 September 2026

Pick one Blue stack (both if time). Target stays host-only.

Path A – Suricata (Ubuntu often easiest; Amazon Linux 2023: try yum, extras, or use Ubuntu sensor VM):

# Amazon Linux / CentOS-style
sudo yum install suricata
# Ubuntu:
# sudo apt update && sudo apt install -y suricata
sudo service suricata start
sudo service suricata status
# Confirm interface in /etc/suricata/suricata.yaml (host-only nic – name varies)
# Set HOME_NET to "[192.168.56.0/24]" then:
sudo service suricata restart
sudo tail -f /var/log/suricata/fast.log
# JSON (if eve enabled):
# sudo tail -f /var/log/suricata/eve.json

Path B – firewalld only (Amazon Linux friendly):

sudo yum install firewalld
sudo systemctl enable firewalld
sudo service firewalld start
sudo firewall-cmd --set-log-denied=all
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.56.0/24" port port="1-1024" protocol="tcp" log prefix="LAB-SCAN " level="warning" drop'
# (lab example – don't blindly drop 22 if you still need SSH; exclude mgmt port)
sudo firewall-cmd --reload
sudo tail -f /var/log/messages

Then from Kali (OWN only):

nmap -sS -T2 192.168.56.20
nmap -sS -T2 -p 22,80,443 192.168.56.40

Expected: some alert or LAB-SCAN / denied line. If zero: wrong NIC, HOME_NET, or VirtualBox host-only promiscuous mode off (needed only if sensor is not the destination). Ghabru naka – debugging the sensor is the lab.