GSoc: Integrate Suricata to Cloudstack

### **Summary**

Currently, Cloudstack only has ACLs (in Advanced Networks) that acts a layer of securing access to the networks (VPCs). However, these only operate in the Layer 3 and 4 of OSI Layer.

In todays day and age, where Cybersecurity threats become more advanced, complex and operate in Layer 7 OSI layer, there needs to be a way for Cloudstack to allow its own tenants to implement its own form of mature cybersecurity solution.

The problem all this while is that if a user is using a VPC or L2 Networks, 3rd party firewalls such as PFsense, FortinetVM Firewall etc cant be implemented effectively due to a lack of being able to set static routes that stays with the VR after it is recreated. There are other limitations that im not fully aware of.

There needs to be a better option for users of cloudstack to implement a deeper form of cybersecurity to protect their workloads.

### **Feature Request for GSoC 2025**

This feature request is to integrate Suricata into Cloudstacks VPC.

Link to Suricata: https://suricata.io/

Suricata is an open source Intrusion Detection System (IDS) and Intrusion Prevention System (IPS). It is under the GPLv2 license, and is widely used. In fact, it is used by AWS to power its 'AWS Network Firewall' service.

Suricata supports the ability to be used in a form of 'Transparent Mode' which i believe is called 'Inline IPS Mode', or Bridged Mode. That way, there, there should be ideally no complex routing logic required (i hope) to implement Suricata, as the VMs will not know it exists.

By integrating Suricata in a 'Transparent Mode', it is able to run as an IPS and filter/block traffic based on the rules. And, each tenant, having set up the suricata themselves, can benefit from implementing their own rules.

### **Benefits To Cloudstack**

- Allows Cloudstack Users to achieve a form of Layer 7 security for their VPCs
- If deployed on each VPC (VR), then suricata rules can be configured (self serviced) to apply only to their desired network without affecting other tenants (If cloud operator implements suricata on shared internet, it may negatively impact the tenants as some rules may not be suitable for specific tenants).
- If deployed in Transparent mode, there should not be a need for complex routing.
- Free Open source tool which can benefit the entire community, and increase the value proposition of Cloudstack.
- Leverage on Suricata Features such as IDS alerts, traffic inspection etc.

### **Expected Deliverables**

- Suricata Inline (Bridge) Mode Implementation - Implementation of Suricata running inline on the Virtual Router (VR) in bridge mode, ensuring Layer 7 traffic inspection without altering the existing routing configuration.

- CloudStack UI/API Enhancements - Extend the CloudStack UI and API to allow tenants to manage their Suricata configurations, including uploading custom rules, enabling or disabling rule sets, and viewing logs/alerts.

- Configuration Persistence Mechanism - Ensure that Suricata configurations and rules persist through VR upgrades or recreations, maintaining seamless, uninterrupted security coverage for tenant workloads

### **Expected Outcomes**
Improved security offering in Cloudstack that allows users to benefit from Layer 7 filtering capabilities using open source solutions

首先梳理 CloudStack VPC 和 virtual-router (VR) 的行为，然后审查提议的 Suricata inline/bridge mode 以及 UI/API 界面。完成标准是：为 inline 检查、租户规则管理和告警，以及 VR 升级或重新创建后的持久化制定出一致认可的实现方案。

由索引模型根据 Issue 内容生成。