Configuring Port Mirroring and Suricata IDS Firewall on Proxmox VE

7 hours ago

The author set up an IDS using Suricata and EveBox on a Proxmox VE (PVE) host to monitor and analyze internal network traffic, addressing security concerns from unexplained activity observed in Netdata.
The setup involves creating a Debian 12 LXC container with two network interfaces: one for normal access (eth0 on vmbr0) and one for port mirroring (eth1 on a new vmbr1 bridge), where vmbr1 carries mirrored traffic from vmbr0.
Port mirroring is achieved using tc (traffic control) commands on the PVE host to duplicate all traffic from vmbr0 to vmbr1, with a script that must be re-run when new VMs or containers are added.
Suricata is compiled from source and configured to listen on eth1, using its default rule set downloaded via suricata-update, with systemd service and logrotate for managing the eve.json log output.
EveBox is installed as a frontend to consume Suricata events, run via systemd, storing data in a SQLite database with automatic rotation (7 days or 15 GB), and provides a web dashboard for event inspection.
The solution offers enterprise-grade traffic analysis with DPI but is noted for its simplicity, low resource usage, and compared to complex alternatives like FortiGate and Sophos, which were found less satisfactory.
The article includes practical configuration details, such as systemd service files and config adjustments, to help readers replicate the setup.

The author's laptop was the bottleneck in AI coding sessions because closing the lid would kill running sessions like Claude Code.
Solution: Move all development work (agents, code, databases, editor GUI) to a VPS, accessible from any device via Tailscale VPN.
Key benefits: close laptop without stopping work, instant handoff between devices, survives dropped connections, no need for caffeine hacks to keep laptop awake.

The author previously used an Arista 7050QX2-32S switch, which is nearing end of life, and sought alternatives due to the vendor's unique support for third-party daemons like BIRD.
Whitebox switching options like SONiC and DENT were considered; DENT uses switchdev for Linux kernel integration, allowing hardware offload similar to Arista.
A Mellanox SN2010 switch with Spectrum ASIC was selected for its switchdev support, and Debian was installed after configuring the kernel and udev rules for mlxsw.

Trifecta is a standalone, open-source image sharing solution with minimal dependencies and a small codebase that can be fully audited in a day.
It offers full user and session management, drag-and-drop multiple images, posts with multiple images, optional titles and captions, and time-limited public sharing.
Features include passwordless login via email, lost password recovery, a single tightly locked cookie, and deployment options as source, binary, Docker, .deb, or .rpm.

The author's homelab had issues with a machine called 'nibbler' that was unreliable and likely defective, purchased as refurbished.
Kubernetes was abandoned due to complexity and maintenance difficulties; the author reverted to using Docker Compose as a simpler solution.
Current homelab setup includes: 'lrrr' (Proxmox host), 'morbo' (TrueNAS SCALE for storage), 'nibbler' (revamped as the main non-critical service machine), and an external VM 'ord-router' for public ingress.

Brow6el is a full-featured terminal web browser using Chromium (CEF) with support for Sixel and Kitty graphics protocols.
The main repository has moved from Codeberg to a new location; Codeberg is kept for reference only.
It features Vim-style modal keyboard control with Standard, Insert, Visual, and Mouse modes.

The author's laptop was the bottleneck in AI coding sessions because closing the lid would kill running sessions like Claude Code.
Solution: Move all development work (agents, code, databases, editor GUI) to a VPS, accessible from any device via Tailscale VPN.
Key benefits: close laptop without stopping work, instant handoff between devices, survives dropped connections, no need for caffeine hacks to keep laptop awake.

The author previously used an Arista 7050QX2-32S switch, which is nearing end of life, and sought alternatives due to the vendor's unique support for third-party daemons like BIRD.
Whitebox switching options like SONiC and DENT were considered; DENT uses switchdev for Linux kernel integration, allowing hardware offload similar to Arista.
A Mellanox SN2010 switch with Spectrum ASIC was selected for its switchdev support, and Debian was installed after configuring the kernel and udev rules for mlxsw.

Trifecta is a standalone, open-source image sharing solution with minimal dependencies and a small codebase that can be fully audited in a day.
It offers full user and session management, drag-and-drop multiple images, posts with multiple images, optional titles and captions, and time-limited public sharing.
Features include passwordless login via email, lost password recovery, a single tightly locked cookie, and deployment options as source, binary, Docker, .deb, or .rpm.

The author's homelab had issues with a machine called 'nibbler' that was unreliable and likely defective, purchased as refurbished.
Kubernetes was abandoned due to complexity and maintenance difficulties; the author reverted to using Docker Compose as a simpler solution.
Current homelab setup includes: 'lrrr' (Proxmox host), 'morbo' (TrueNAS SCALE for storage), 'nibbler' (revamped as the main non-critical service machine), and an external VM 'ord-router' for public ingress.

Brow6el is a full-featured terminal web browser using Chromium (CEF) with support for Sixel and Kitty graphics protocols.
The main repository has moved from Codeberg to a new location; Codeberg is kept for reference only.
It features Vim-style modal keyboard control with Standard, Insert, Visual, and Mouse modes.

Hasty Briefsbeta