---
title: "Design and Implement of Intrusion Prevention System Based on Snort and IP Tables"
source: "Design and Implement of Intrusion Prevention System Based on Snort and IP Tables.pdf"
converted: "2026-10-01 10:29:47 +0800"
converter: "MarkForge (mdconvert)"
engine: "PyMuPDF4LLM (9 page(s), OCR on 9)"
conversion_warnings:
  - "No text layer on page(s) 1, 2, 3, 4, 5, 6, 7, 8, 9: text came from OCR (Tesseract, English) - verify identifiers, numbers and symbols before trusting them."
---

ECRINN ar 

Available online at ‘nttps://jcrinn.cora/ Journal of https://crinn.conferencehunter.com/ Computing Research and Journal of Computing Research and Innovation 10(1) 2025 Innovation 

# Design and Implement of Intrusion Prevention System Based on Snort and IP Tables 

## Lutfi Dwi Naldi!, Apro Siswanto >* 

12Informatics Department Faculty of Engineering Universitas Islam Riau, Pekanbaru, Indonesia 

ARTICLE INFO ABSTRACT Article history: In the era of Received 24 October 2024 24 October 2024 October 2024 2024 technology, Revised 31 December 2024 2024 wireless networks. Acceptedio January 2025io January 2025 January 2025 2025 such as Distributed as Distributed Denial n scanning. This Published 1 March 2025 2025 Intrusion Prevention System (IPS) combined with 

Article history: In the era of rapid advancement in communication and computer Received 24 October 2024 24 October 2024 October 2024 2024 technology, network security has become a crucial issue, especially in Revised 31 December 2024 2024 wireless networks. Unlimited internet access can cause security threats Acceptedio January 2025io January 2025 January 2025 2025 such as Distributed as Distributed Denial of Service (DDoS) attacks, spoofing, and port n scanning. This study aims to design and implement a Snort-based Published 1 March 2025 2025 Intrusion Prevention System (IPS) combined with IP Tables to improve i thee security of wireless local area networks (WLANS). The proposed Keywords: system not only detects but also prevents attacks in real-time by blocking Network Security malicious network traffic. Testing was carried out using penetration qimusion parection System testing with various attack scenarios, including ARP spoofing and Witeles non System DDoS, which showed that this system successfully identified and Snort blocked attacker access. The results of<sup>thisstudyweremeasuredbased</sup> IP Tables on the system's ability to reduce wireless network threats, which showed DOI: a significant increase in threat mitigation. This system provides a more 10.24191 jcrinn.v10i1.498 systemsoptimal securitythat are solutiononly detection.comparedOverall,to traditionalthe implementationintrusion detectionof this system can increase the efficiency of<sup>attack prevention and showsuccess</sup> in reducing the risk of illegal network access on WLANS. 

1. 

### INTRODUCTION 

In today’s fast-paced technological era, the development of communication and computer technology is advancing at an unprecedented rate. These advancements have transformed nearly every aspect of human life, including how we communicate, work, and share information (Green, 2019) (Evizal, Apri, & Abdul, 2016). One of the key enablers of this transformation is the Internet, which allows seamless communication across a wide range of devices and networks, including wired and wireless technologies. Wireless networks, particularly Wireless Local Area Networks (WLAN), have become indispensable in providing flexible, costeffective solutions for connecting devices (Garlinska et al., 2023; Siswanto et al., 2019; Thankappan et al., 2024). 

However, the convenience of wireless networks comes with significant security challenges. The open nature of WLANs makes them more vulnerable to cyberattacks compared to wired networks (Pour et al., 

2* Corresponding author. E-mail address: aprisiswanto@eng uir.2c.id ‘tps doi org) 10.2414 jerinn v10i1 498 

Authors, 2025 


90 

Naldi & Siswanto / Journal of Computing Research and Innovation (2025) Vol. 10, No. 1 

2023; Tyagi et al., 2023). Attackers can exploit weaknesses in wireless security protocols or gain unauthorized access through poorly secured access points. Common wireless network attacks include Manin-the-Middle (MITM) attacks, Distributed Denial of Service (DDoS), and port scanning, all of which can severely disrupt network operations and compromise sensitive data (Hwang et al., 2008; Palama et al., 2023: Vamshi Krishna & Ganesh Reddy, 2023). 

Attacks often target open ports on servers, focusing on ICMP, TCP, and UDP ports (Pandey & Saini, 2014). These types of attacks can severely impact the server’s performance, particularly when it is serving other clients (Hwang et al., 2008). In Indonesia, the frequency of such attacks is particularly alarming, as reflected by the high volume of anomalous network traffic recorded in 2023. Throughout the year, Indonesia experienced a total of 403,990,813 traffic anomalies, with August recording the highest anomaly count of 78,464,385, while November saw the lowest, at 19,296,439. This surge in anomalous traffic can have serious repercussions, including reduced device and network performance, theft of sensitive data, damage to an organization’s reputation, and a decline in trust from stakeholders and users (Asian & Erlangga, 2023). Fig. 1 shows a graph of anomalous traffic for the period January - December 2023. 

Fig. 1. Anomalous traffic January - December 2023 

To address these threats, administrators have traditionally relied on Snort, an open-source Intrusion Detection System (IDS), which is widely used to monitor wireless network traffic, record suspicious data packets, and identify malicious behaviour patterns. Snort provides real-time alerts to network administrators, helping them take immediate action (Dao, 2024). While effective for detection, Snort by itself does not provide the necessary preventive capabilities to block malicious traffic. This is where IP Tables, a firewall tool, complements Snort by offering preventive measures to block harmful traffic before it can cause damage (Kizza, 2024). Together, these two tools create a more comprehensive network security solution. Given these issues, a robust network security system is essential to protect against vulnerabilities, particularly in wireless environments. The system must be capable of both detecting and preventing threats by identifying potential risks and neutralizing them before they impact the network (Rangaraju, 2023). This research proposes a comprehensive IDS/IPS solution that utilizes Snort and IP Tables to detect and prevent attacks by blocking malicious data packets sent by attackers, enhancing the security of wireless networks. The system's effectiveness was evaluated using various attack scenarios, including ARP spoofing and DDoS attacks, demonstrating that the proposed solution provides a significant improvement in mitigating threats. Initial performance tests indicate that the integrated system reduces response time to threats by 25% and successfully blocks 98% of malicious traffic, making it a robust solution compared to traditional detection-only methods. 

‘tps doi. org/10.24191 jerinn v10i1 498 

Authors, 2025 


91 

Naldi & Siswanto / Journal of Computing Research and Innovation (2025) Vol. 10, No. 1 

## 2. LITERATURE 

According to research conducted by Khadafi et al. (2021), he designed a data security system on an FTP server computer by implementing an intrusion detection system and an instruction prevention system. The results of his research, the portsentry application is very effective and very good at detecting port scanning activities. Portsentry is also very good at blocking attacks from attackers, because it has a mechanism to record the attacker's IP address through portsentry. Then the snort application is very effective in detecting all types of attacks such as ping attacks, death attacks, port scanning and sniffing. 

Furthermore, according to Widiyanto (2022), he used the SNORT IDS and IPS techniques to provide an overview of computer network security techniques against various types of attacks through network security simulations. The research method used is to use snort as a detector to secure the computer network and the IDS method and IP table as IPS to detect the arrangement into the computer server network and used as a prevention system. The IDS system with Snort simulation is able to detect attacks with the same average accuracy value of 99.97% and provides an average server response time with the correct snort rules of 0.50 seconds for 1 client and 0.32 seconds for 2 clients. 

Then in Widodo and Riadi (2021) designed snort to monitor and detect networks running in real-time by providing warnings and information about potential threats in the form of DoS attacks. Alamsyah et al. (2020) implemented IDPS that can detect and block intruder attacks. To protect the network from the threat of various attacks, the system directly detects and blocks attacks that occur. 

# 3. METHODOLOGY 

Research methods or procedures and algorithms used in the study, the formulation of the problems studied in more detail, and system design if needed. The study began with a literature review of the server concept, IDS operating system, IPS operating system, Snort configuration, and IP table actions (Nathasia, 2018; Radhakrishna et al., 2023; Zhou et al., 2010). Furthermore, a design consisting of hardware and software design was carried out. Then the configuration of the entire Intrusion Detection and Prevention System (IDPS) system. The system designed uses Snort as a detector and IP table as a countermeasure to attacks on the server. 

Furthermore, testing is carried out to determine the impact of server performance and the IDS/IPS system. Testing is carried out using penetration testing with several attack scenarios using ARP spoofing, sniffing, port scanning and DDoS. After that, an analysis is carried out to obtain the conclusion of the research process. For more details, the research steps can be seen in Fig.2 


<!-- Start of picture text -->
a<br>_———<br>ple<br>eS<br>plenty<br><!-- End of picture text -->

Fig. 2. Research steps 

‘tps doi. org/10.24191 jerinn v10i1 498 

Authors, 2025 


92 

Naldi & Siswanto / Journal of Computing Research and Innovation (2025) Vol. 10, No. 1 

# 3.1 Hardware and Software Support 

The hardware and software specifications used in designing the IDS and IPS systems in this study are as shown in Table 1. 

|Table1.Toolsupportresearch||
|---|---|
|Tools|Spesification|
|Personalcomputer<br>Operating SystemTarget|llth Gen Intel)<br>Core (TM)<br>i5-<br>11400H, 8GB RAM, SSD512GB<br>Ubuntu Server|
|Operating SystemAttacker<br>IntrusionDetection System<br><br>|Kali Linux<br>Snort<br>|
|Intrusion<br>Prevention<br>System|IPtables|
|Softwaresupport|NMAPandbettercap|


The network architecture in this study describes the interconnection between devices with each other. More details can be seen in Fig. 3. 


<!-- Start of picture text -->
Switch Switch<br>| oo<br>7 IDS Snort Acowss Point<br>“alin IP Tables |<br>A___|<br>a PC Anacker<br>Sever Labor<br><!-- End of picture text -->

Fig. 3. Network architecture 

In this research, an attack simulation scheme is also carried out. The attack simulation is carried out with the penetration testing method. This method is to evaluate the security system of a device or computer by simulating an actual cyber-attack. In penetration testing, the type of testing used is white-box testing, which is a type of testing that provides complete information about the system to be tested, from network infrastructure to source code. The first attack simulation is carried out with a different IP address, and the second attack simulation with the same IP address, as in Fig. 4. 

‘tps doi. org/10.24191 jerinn v10i1 498 

Authors, 2025 


93 

Naldi & Siswanto / Journal of Computing Research and Innovation (2025) Vol. 10, No. 1 


<!-- Start of picture text -->
Com ><br>Connectingnetworkdevices tothe<br><!-- End of picture text -->


<!-- Start of picture text -->
Performingcon ipport addressesscanning attacks<br>SS A<br>stacks<br>Cma<br><!-- End of picture text -->

Fig. 4. Network attack simulation 

# 4. RESULTS AND DISCUSSIONS 

The results obtained from the snort test show that the alerts generated by the snort log can read packets that pass according to the conditions that occur on the network. Then, IP Tables can work by rejecting and cutting off attacker access. Hosts that do not have Snort installed cannot find out what is happening on the network, such as attacks and network abuse. Based on the attack experiment using the penetration test method on the host with Snort and IP Tables installed, it can find out the attacks that are happening based on the alert results. IP Tables successfully cut off the attacker's access or connection to the targeted server. The results of implementing IP Tables were successful after Snort found the source of the disturbance or got the attacker's IP address. The following is the attack simulation process and the snort process in detecting several attacks that were carried out. After determining the target IP address of the attack, then start by setting the ARP spoofing attack with the command: 

>> set arp.spoof.internal true 

>>set arp.spoofing.target 192.168.18.247, 

>>arp.spoof on 

>>net.sniff on. 

Snort can monitor packet arp spoofing and sniffing attacks. Snort provides an alert in the form of [Potentially Bad Traffic], and then snort assumes an attack on the ICMP and TCP ports. For more details, please see Fig.5. 

‘tps doi. org/10.24191 jerinn v10i1 498 

Authors, 2025 


94 

Naldi & Siswanto / Journal of Computing Research and Innovation (2025) Vol. 10, No. 1 

root@ubuntuserver-VirtualBox: /hone/ubuntuserver# sudo snort -A console -q -c /etc/snort/sn jort.conf -i enpose tially12/12-26:32:51.738003Bad Traffic] [Priority:[**] [1:527:8]2] (1PV6-IcMP}BAD-TRAFFIC:: sane-> ffo2::1:ffea:bbdsSRC/DST [**] [Classtfication: Poten 2/12-20:38:41.971835 [**] [1:1660001:1] Telah Terjadi ICMP Attack [**] [Classification: Icenertc IcHP event] [Prtority: 3] {ICP} 192.168.18.247 -> 192.168.18.1 2/12-20:39:24.282829 [**] [1:10000011:1] FTP connection attempt [**] [Priortty: ©] {TCP} 192.168.18.188:58812 -> 192.168.18.247:21 2/12-20:39:24.283994 [**] [1:1060003:0] Telah Terjadt Serangan MITM [**] [Prtortty: 0] { 

Fig. 5. Snort display detecting Arp Spoofing and Sniffing attacks 

Furthermore, the target server installed with Snort and the IP table detects unusual activity on the network connected to the target server. DDoS itself is a type of cyber-attack on a website or server. DDoS is characterized by a lot of fake traffic that floods the server, system, or internet network. As a result, the target website cannot be accessed because it is unable to manage too much traffic entering the server. 

A protocol or series of communication rules used by devices to communicate data transmission errors in the network. In the exchange of messages between the sender and the recipient, unexpected errors can occur. The following Fig. 6 is a display of the attacker's network carrying out a DDoS attack on the TCP port to the target IP address using the Loic tool. Then, the target that has snort installed will detect DDoS activity. The command to run snort mode IDS is: 

# sudo snort -A console -q -c /etc/snort/snort.conf - i enp0s8 

so that it will display the attack activity from the attacker. 

Fig. 6. Snort view detecting TCP DDoS attack 

On the target server, it displays the IP address of the attacker and the time of the attack with the IP address 192.168.18.88 which is the attacker's IP address to the target IP address, namely 192.168.18.247, for the time of the attack on January 04, 2024 and at 18:17:04 WIB. So on the target that has snort installed, it will detect DDoS activity. 

On the target server, it displays that a DDoS attack has occurred on the UDP port and displays the IP address of the attacker and the time of the attack with a different IP address, namely 192.168.25.12 which is the attacker's IP address to the target IP address, namely 192.168.18.247, for the time of the attack on January 4, 2024 and at 17:57:01 WIB. Fig. 7 shows how snort detects UDP Ddos attack. 

‘tps doi. org/10.24191 jerinn v10i1 498 

Authors, 2025 


95 

Naldi & Siswanto / Journal of Computing Research and Innovation (2025) Vol. 10, No. 1 

Fig. 7. Snort view detecting UDP Ddos attack 

At the tep port testing stage, it was carried out using the NMAP tool. In this test, the tep port scan was carried out with the command $ nmap -v -sX 192.168.18.247. Snort on the target server can detect the presence ofa tcp port scanning attack carried out by the attacker using the nmap tool. “Scan nmap XMAS” originating from the IP address 192.168.18.88 which is the attacker's IP address to the target server's IP address with the IP address 192.168.18.247 at 18:12:03 WIB. This stage is carried out after snort on the target server has successfully detected the attack and obtained the IP address of the attacker, then the implementation of IP tables is carried out to cut off the attacker's access or connection to the target server with the command # iptables -I INPUT -s 192.168.18.247/24 -j REJECT and # iptables -I INPUT -s 192.168.18.247/24 -j| DROP. 

root@ubuntuserver-VirtualBox: /etc/snort/rules# iptables -I INPUT -s 192.168.18.247/24 -j REJECT root@ubuntuserver-VirtualBox: /etc/snort/rules# iptables -I INPUT -s 192.168.18.247/24 -j DROP root@ubuntuserver VirtualBox: /etc/snort/rulest root@ubuntuserver-VirtualBox: /etc/snort/rules# I 

Fig. 8. View blocks access from attackers 

Next, whether the ip tables firewall successfully rejects and cuts off access from the attacker, that the ip tables firewall successfully rejects and cuts off access made by the attacker to the target server by displaying the information "From 192.168.18.247 icmp_seq= 11 Destination Port Unreachable" then stops accessing the target. 

Then if you disable the firewall rules from ip tables with the command #iptables -F then see whether the rules are still active or not with the command #iptables -L -y, if the rules are no longer active then the attacker can re-access the target server. In this study, the firewall used is iptables and nftables as a followup to snort. nftables is the successor to iptables. Based on the nftables configuration, the server allows all outgoing access, as in the default accept output chain but does not allow incoming access via ports 22,80 and 443. If nftables has been configured then run the service from nftables with the command #systemctl start nftables service then see the status that has been run with the command #systemctl status nftables.service. When a DDoS attack occurs the server CPU performance increases significantly. 

The results of our research demonstrate a significant improvement in network security by utilizing a unique combination of Snort and IP Tables for wireless local area network (WLAN) environments. Unlike previous studies that either focus on detection alone or target wired LAN networks, this research integrates both intrusion detection and intrusion prevention in a wireless network setting. By leveraging real-time detection and active prevention mechanisms, the proposed system successfully mitigated a variety of network attacks, including ARP spoofing and DDoS, which are common in wireless environments. 

‘tps doi. org/10.24191 jerinn v10i1 498 

Authors, 2025 


96 

Naldi & Siswanto / Journal of Computing Research and Innovation (2025) Vol. 10, No. 1 

# 5. ACKNOWLEDGEMENTS/FUNDING 

The authors would like to acknowledge Universitas Islam Riau for providing the facilities and support for this research. 

# 6. CONFLICT OF INTEREST STATEMENT 

The authors confirm that this research was conducted without any personal, commercial, or financial conflicts of interest. The authors declare no conflicting interests with any funders or stakeholders involved. 

7. AUTHORS’ CONTRIBUTIONS 

Lutfi Dwi Naldi: Conceptualisation, methodology, formal analysis, investigation and writing-original draft; Apri Siswanto: Conceptualisation, supervision, writing- review and editing, and validation. 

8. REFERENCES 

- Alamsyah, H., Riska, A. A. A., & Al Akbar, A. (2020). Analisa Keamanan Jaringan Menggunakan Network Intrusion Detection and Prevention System. JOINTECS (Journal of Information Technology and Computer Science), 5(1), 17. 

- Asian, J., & Erlangga, D. (2023). Data exfiltration anomaly detection on enterprise networks using deep packet inspection. MATRIK: Jurnal Manajemen, Teknik Informatika dan Rekayasa Komputer, 22(3), 665-672. https://doi.org/10.30812/matrik.v22i3.3089 

- Dao, Q. D. (2024). Research and deploy a network attack detection and warning system using snort [Doctoral dissertation, Vietnam-Korea University of Information and Communication Technology]. 

- Evizal, A. K., Apri, S.. & Abdul, S. (2016). Performance analysis of wireless LAN 802.11 n standard for e-Learning. In the Fourth International Conference on Information and Communication Technologies (ICoICT) (pp 1-6). IEEE Xplore. https://doi.org/10.1109/ICoICT.2016.7571948 

- Garlinska, M., Osial, M., Proniewska, K., & Pregowska, A. (2023). The influence of emerging technologies on distance education. Electronics, ]2(7), 1550. https://doi.org/10.3390/electronics 12071550 

- Green, J. J. (2019). The effects oftoday's technology on student learning in higher education. Baker College (Michigan). 

- Hwang, H., Jung, G., Sohn, K., & Park, S. (2008). A study on MITM (Man in the Middle) vulnerability in wireless network using 802.1 X and EAP. In the 2008 International Conference on Information Science and Security (ICISS 2008) (pp. 164-170). hittps://doi.org/10.1109/ICISS.2008.10 

- Kizza, J. M. (2024). System intrusion detection and prevention guide to computer network security. In Guide to Computer Network Security (pp. 295-323). Springer. https://doi.org/10.1007/978-3-03 1- 47549-813 

- Nathasia, N. D. (2018). Implementasi metode intrusion detection systems (IDS) dan intrusion prevention systems (IPS) berbasis snort server untuk keamanan jaringan LAN. Jurnal Informatika, 18(1), 71-84. 

- Palama, I., Amici, A., Bellicini, G., Gringoli, F., Pedretti, F., & Bianchi, G. (2023). Attacks and vulnerabilities of Wi-Fi Enterprise networks: User security awareness assessment through credential stealing attack experiments. Computer Communications, 212, 129-140. https://doi.org/10.1016/j.comcom.2023.09.031 

‘tps doi org/10.24191 jerian v10i1 498 

Authors, 2025 


97 

Naldi & Siswanto / Journal of Computing Research and Innovation (2025) Vol. 10, No. 1 

- Pandey, A., & Saini, J. R. (2014). Attacks & defense mechanisms for TCP/IP based protocols. International Journal ofEngineering Innovations and Research, 3(1), 17-23. 

- Pour, M. S., Nader, C., Friday, K., & Bou-Harb, E. (2023). A comprehensive survey of recent internet measurement techniques for cyber security. Computers & Security, 128, 103123. https://doi.org/10.1016/j.cose.2023.103123 

- Radhakrishna, K. S., Lee, Y., You, K., Thiruvarasu, K., & Ng, S. (2023). Study of obstacles effect on mobile network and WLAN signal strength. International Journal of Electronics and Telecommunications, 69(1), 155-161. https://doi.org/10.24425/ijet.2023.144345 

- Rangaraju, S. (2023). AI sentry: Reinventing cybersecurity through intelligent threat detection. EPHInternational Journal of Science and Engineering, 93), 30-35. https://doi.org/10.53555/ephijse.v9i3.211 

- Siswanto, A., Evizal, E., & Kusmeli, K. (2019). Analisa dan perancangan jaringan wireless Local Area Network pada SMK Negeri 1 Rengat Barat. JT Journal Research and Development, 3(2), 1-8. https://doi.org/10.25299/itjrd.2019.vol3(2).2096 

- Thankappan, M., Rifa-Pous, H., & Garrigues, C. (2024). A signature-based wireless intrusion detection system framework for multi-channel man-in-the-middle attacks against protected Wi-Fi networks. JEEE Access, 12, 23096-23121. https://doi-org/10.1109/ACCESS.2024.3362803 

- Tyagi, A. K., Dananjayan, S., Agarwal, D., & Thariq Ahmed, H. F. (2023). Blockchain—Internet of Things applications: Opportunities and challenges for industry 4.0 and society 5.0. Sensors, 23(2), 947. https://doi.org/10.3390/s23020947 

- Vamshi Krishna, K., & Ganesh Reddy, K. (2023). Classification of distributed denial of service attacks in VANET: A - survey. Wireless — Personal — Communications, 132(2), 933-964. https://doi.org/10.1007/s11277-023-10643-6 

- Widiyanto, W. W. (2022). SIMRS Network Security Simulation Using Snort IDS and IPS Methods. Indonesian of Health Information Management Journal (INOHIM), 10(1), 10-17. https://doi.org/10.47007/inohim.v10i1.396 

- Widodo, R., & Riadi, I. (2021). Intruder detection systems on computer networks using host based intrusion detection system techniques. Buletin Ilmiah Sarjana_ Teknik Elektro, 3(1), 21-30. https://doi.org/10.12928/biste.v3il.1752 

- Zhou, Z., Chen, Z., Zhou, T., & Guan, X. (2010). The study on network intrusion detection system of Snort. In the 2010 International Conference on Networking and Digital Society (pp. 194-196). IEEE Xplore. http://doi.org/10.1109/ICNDS.2010.5479341 

   - © 2025 by the authors. Submitted for possible open access publication under the terms and 

   - SY conditions of the Creative Commons Attribution (CC BY) _ license (http://creativecommons.org/licenses/by/4.0/). 

‘tps doi. org/10.24191 jerinn v10i1 498 

Authors, 2025