Snort mailing list archives
SNORT GURUZ: Question regarding Setting up Snort on a multi-WAN network
From: Sanjay Arora <sanjay.k.arora () gmail com>
Date: Thu, 09 Nov 2006 16:22:37 +0530
Hello all Newbie planning to setup Snort on a Small Office Network, consisting of two 512kB/1MB ADSL WAN links with two static IPs, one LAN segment, one DMZ and one Wi-Fi segment, connecting through a pfsense (www.pfsense.org) box (freebsd based monowall fork) acting as a firewall/gateway. What is the best way to setup Snort, for analysis & IPS (simple blackholing of attacking IPs for a few hours). Do I setup sensors on a machine in each segment? What snort database based analysis app is recommmended? Seperate Snort server? or a combined snort machine & database machine? How do I sniff the WANs for snort? Is it possible for the snort machine to have two network cards for sniffing wan traffic but not expose an IP address to the WAN interface....esentially the nort machine has to connect to al network segments and if this machine is broken into, it will make a mockery of all my network security. Ambitious project for a newbie but then I really do want to try & build a well-segmented IDS security dimention to my network. Snort Guru's please help with comments & pointers. I use Centos 4.2, postgreSQL mostly but willing to change if an easier build is available on another platform. With best regards. Sanjay. ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- SNORT GURUZ: Question regarding Setting up Snort on a multi-WAN network Sanjay Arora (Nov 09)