Turning OPNsense IDS from Passive to Active in 30 Minutes with AI — Stop Ignoring Your Firewall

1Is Enabling IDS Enough?

OPNsense ships with a Suricata-based IDS/IPS. You enable it in the menu, download rulesets, and alerts start accumulating. Many setups stop there.

The problem is that IDS only detects — prevention requires separate configuration. By default, suspicious packets are logged but allowed through. That is why months of IDS operation can produce zero actual blocks.

2Three Reasons IDS Doesn’t Block Anything

3Setup — SSH Key Registration and API Access

Giving AI direct control over OPNsense requires two access paths: SSH for running commands directly, and the REST API for configuration changes.

SSH Key Registration

Copy your public key, then paste it into the OPNsense web GUI under System → Access → Users → root → Authorized keys. Straightforward in principle, but OPNsense runs on FreeBSD which has a few gotchas.

API Key Generation

In the OPNsense web GUI, go to System → Access → Users and open the API tab to generate an API Key and Secret. The secret is shown only once at download time — store it immediately.

4Using the OPNsense API

Nearly every OPNsense function is accessible via REST API. Passing API_KEY and API_SECRET as environment variables lets AI query firewall state and apply changes with single curl calls.

# Base configuration
API="https://192.168.1.1/api"
AUTH="$API_KEY:$API_SECRET"

# Check firmware status
curl -sk "$API/core/firmware/status" -u "$AUTH"

# Query IDS alerts (latest 100)
curl -sk "$API/ids/service/queryAlerts" \
  -u "$AUTH" -X POST \
  -d '{"current":1,"rowCount":100}'

# Apply rule updates
curl -sk "$API/ids/service/updateRules" \
  -u "$AUTH" -X POST

# Restart IDS service
curl -sk "$API/ids/service/restart" \
  -u "$AUTH" -X POST

AI calls these endpoints in sequence — query current state, apply changes, verify results. The feedback loop is much faster and more consistent than clicking through the GUI.

5What AI Did Step by Step

I gave AI the API credentials and asked it to assess the firewall’s security posture and build an active blocking configuration. Over about 30 minutes of conversation, it worked through the following sequence.

6Results After Configuration

The before/after contrast is clear. 65 alerts all passing through became 22 blocked and 15 allowed — only legitimate traffic getting through.

Suppress Configuration Example

sig_id 2001978 is the “ET POLICY SSH session in progress on non-standard port” rule. Two external backup servers connect via SSH and consistently triggered this rule. Since this is legitimate traffic, only those specific destination IPs are exempted.

# OPNsense IDS Suppress Rules
suppress gen_id 1, sig_id 2001978, track by_dst, ip 14.51.225.150   # Backup server A
suppress gen_id 1, sig_id 2001978, track by_dst, ip 211.213.5.223   # Backup server B
suppress gen_id 1, sig_id 2001978, track by_dst, ip 20.200.245.247  # GitHub SSH

7Real Attacks Blocked

Blocking started immediately after DROP rules were applied. The following attacks targeting our public IP (218.48.87.25) were blocked by IDS.

Blocked Attacks

Legitimate Traffic (Allowed)

8Firewall Management Tips

Don’t put emerging-policy.rules in DROP

Emerging Threats’ emerging-policy.rules contains informational rules — SSH session detection, ZIP files containing EXEs, and similar. Including this ruleset in a DROP policy blocks normal SSH connections and file downloads. Keep it as Alert-only or exclude it entirely.

# Informational ruleset — Alert only, not DROP
emerging-policy.rules   → Action: Alert  (not DROP)
emerging-exploit.rules  → Action: Drop   (real attack signatures)
emerging-scan.rules     → Action: Drop   (port scan detection)

Record Review Results in Dated Markdown Files

Keeping dated Markdown files for each firewall review session pays off in two ways: records are immediately available for security audits, and attack pattern changes become visible over time.

# Review log structure
firewall-review/
├── 2026-04-06.md  ← IDS activated, 2310 DROP rules, 3 suppress entries
├── 2026-05-01.md
└── 2026-06-01.md

IDS Review Cadence

Summary

There is a meaningful gap between having IDS enabled and having it actually work. Applying the policy change with a rule file regeneration, enabling the update cron, and handling suppress rules — skip any of these three and IDS is just a log collector.

All three can be done in 30 minutes with AI and the OPNsense API. Alert classification, suppress configuration, and cron activation all happen in sequence. Adding an AI-assisted review to a monthly maintenance routine cuts the overhead of firewall management significantly.