This try follow PVE Firewall#_suricata_ips_integration
- install suricata
apt-get -y install suricata jq
modprobe nfnetlink_queue
echo "nfnetlink_queue" > /etc/modules-load.d/nfnetlink_queue.conf
sed -i 's/NFQUEUE=.*/NFQUEUE=0-3/' /etc/default/suricata