GSoc: Integrate Suricata to Cloudstack

### **Summary**

Currently, Cloudstack only has ACLs (in Advanced Networks) that acts a layer of securing access to the networks (VPCs). However, these only operate in the Layer 3 and 4 of OSI Layer.

In todays day and age, where Cybersecurity threats become more advanced, complex and operate in Layer 7 OSI layer, there needs to be a way for Cloudstack to allow its own tenants to implement its own form of mature cybersecurity solution.

The problem all this while is that if a user is using a VPC or L2 Networks, 3rd party firewalls such as PFsense, FortinetVM Firewall etc cant be implemented effectively due to a lack of being able to set static routes that stays with the VR after it is recreated. There are other limitations that im not fully aware of.

There needs to be a better option for users of cloudstack to implement a deeper form of cybersecurity to protect their workloads.

### **Feature Request for GSoC 2025**

This feature request is to integrate Suricata into Cloudstacks VPC.

Link to Suricata: https://suricata.io/

Suricata is an open source Intrusion Detection System (IDS) and Intrusion Prevention System (IPS). It is under the GPLv2 license, and is widely used. In fact, it is used by AWS to power its 'AWS Network Firewall' service.

Suricata supports the ability to be used in a form of 'Transparent Mode' which i believe is called 'Inline IPS Mode', or Bridged Mode. That way, there, there should be ideally no complex routing logic required (i hope) to implement Suricata, as the VMs will not know it exists.

By integrating Suricata in a 'Transparent Mode', it is able to run as an IPS and filter/block traffic based on the rules. And, each tenant, having set up the suricata themselves, can benefit from implementing their own rules.

### **Benefits To Cloudstack**

- Allows Cloudstack Users to achieve a form of Layer 7 security for their VPCs
- If deployed on each VPC (VR), then suricata rules can be configured (self serviced) to apply only to their desired network without affecting other tenants (If cloud operator implements suricata on shared internet, it may negatively impact the tenants as some rules may not be suitable for specific tenants).
- If deployed in Transparent mode, there should not be a need for complex routing.
- Free Open source tool which can benefit the entire community, and increase the value proposition of Cloudstack.
- Leverage on Suricata Features such as IDS alerts, traffic inspection etc.

### **Expected Deliverables**

- Suricata Inline (Bridge) Mode Implementation - Implementation of Suricata running inline on the Virtual Router (VR) in bridge mode, ensuring Layer 7 traffic inspection without altering the existing routing configuration.

- CloudStack UI/API Enhancements - Extend the CloudStack UI and API to allow tenants to manage their Suricata configurations, including uploading custom rules, enabling or disabling rule sets, and viewing logs/alerts.

- Configuration Persistence Mechanism - Ensure that Suricata configurations and rules persist through VR upgrades or recreations, maintaining seamless, uninterrupted security coverage for tenant workloads

### **Expected Outcomes**
Improved security offering in Cloudstack that allows users to benefit from Layer 7 filtering capabilities using open source solutions

Comienza por documentar el comportamiento de CloudStack VPC y virtual-router (VR) y, después, revisa el modo inline/bridge propuesto para Suricata y las superficies de UI/API. Se considerará completado cuando exista una implementación acordada para la inspección inline, la gestión de reglas y alertas por parte de los tenants, y la persistencia durante las actualizaciones o la recreación de VR.

Escrito por el modelo de indexación a partir del texto del issue.