IPS (Intrusion Prevention)

The QROS IPS is the active sibling of the firewall: a HAProxy WAF with ModSecurity and the OWASP Core Rule Set that not only drops known-bad clients but also blocks malicious requests in real time — SQLi, XSS, RCE, protocol smuggling — and is fed by IDS events so a signature hit in Suricata becomes an instant deny in the WAF.

QROS · IPS · WAFblocking
418blocked / min
62SQLi
29XSS
Active protections
ModSecurity
OWASP CRS
Anti-Tor
Anti-Proxy/VPN
Anti-Bots
Anti-Scan
Block from IDS
Recent blocks
185.220.101.x · Tor exit · SQLidrop
45.155.205.x · proxy · XSSdrop
91.243.59.x · scanner · RCEdrop

WAF rule set

ModSecurity runs the OWASP Core Rule Set in blocking mode, with paranoia tuned per backend. QROS generates the HAProxy frontend that wires ModSecurity as a filter and deploys it over Ansible alongside the firewall filtering rules.

IDS-fed blocking

When Suricata or Snort raises an alert on a source, that source is pushed to the WAF deny list so subsequent requests are dropped at the edge — detection becomes prevention. Alerts and drops are visible in SOC monitoring.

FAQ

What is the difference between the firewall and the IPS?

The firewall is the edge filtering layer (drop Tor, proxy/VPN, bots, scanners). The IPS adds the WAF — ModSecurity + OWASP CRS — to block malicious requests (SQLi, XSS, RCE) and is fed by IDS alerts. The IPS includes the firewall; the firewall is the lighter, filter-only deployment.

Does the IPS block legitimate traffic?

OWASP CRS runs in anomaly-scoring mode with a tuned paranoia level per backend, and QROS starts in detection-only mode so you can review false positives before switching to blocking.

Try this service with QROS

Explore now →