IPS on a public KVM bridge, our small project cs-public0

[wd-ppisz]

Hi,

We wanted to share a small security project dedicated to protecting CloudStack's public bridge. With the recent CVE outbreaks, we were wondering how to protect client VMs without passing all client traffic through our physical security stack. We decided that the best solution would be to run an IPS/IDS at the public bridge level with KVM. This provides a distributed and quite flexible architecture. The entire project is designed to allow traffic to pass through rather than forcefully block it. This project is primarily designed for smaller clouds (edge), we've implemented it in production and we're still working on an anti-DDoS layer. I hope this will be useful to someone; it would also be great to hear other ideas in this area.
Here's a note about the project, and the project itself is available here.

Best regards,
Piotr & WebDisk Team

[kiranchavala]

Nice Project @wd-ppisz will take a look

I was exploring using suricata as vnf appliance in cloudstack