Snort mailing list archives
Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall)
From: wkitty42 () windstream net
Date: Wed, 29 Mar 2017 15:27:12 -0400
On 03/29/2017 02:15 PM, Stanford Prescott wrote:
I need to know if the multiple interfaces can all be bridged to the WAN interface such that: WAN eth0 <---inline snort 1 -->LAN eth1 WAN eth0 <---inline snort 2 -->LAN eth2 etc. Can it be done?
i don't think it can be done like that... likely it should be more like this... WAN0(eth0) -> snort0 -> WAN0(eth1) -> current path for WAN0 to LANs LAN0(eth2) -> snort1 -> LAN0(eth3) -> current path for LAN0 to LANs & WAN0 LAN1(eth4) -> snort2 -> LAN1(eth5) -> current path for LAN1 to LANs & WAN0 LAN2(eth6) -> snort3 -> LAN2(eth7) -> current path for LAN2 to LANs & WAN0 each snort instance has to have its own two interfaces to bridge... remember, each bridge is a dedicated tunnel from one entry point to the exit point with snort processing the data traveling through the tunnel... something else to think about: each snort should also have its own configs... some parts of the configs can be common and shared between all snort instances while others must be discrete and separate... one should also consider the need for different rules to be in effect for the different snort instances... eg: LAN0 may allow TOR traffic but TOR is denied on LAN1 and LAN2... PS: i see you ;)
On Tue, Mar 28, 2017 at 1:20 PM, Stanford Prescott <stan.prescott () gmail com> wrote:I am trying to learn some of the ins and outs of snort. Is there a tutorial somewhere that outlines how to setup snort in inline mode using daq on a Linux netfilter firewall. It is a typical firewall setup with interfaces of, for example: eth0 -> WAN interface with public IP address eth1 -> 1st protected LAN interface with unique subnet eth2 -> 2nd protected LAN interface with unique subnet etc.... I would need multiple instances of snort with instance1 eth0 <---> eth1 (bidirectional) instance2 eth0 <---> eth2 " etc. Thank you!
-- NOTE: No off-list assistance is given without prior approval. *Please keep mailing list traffic on the list* unless private contact is specifically requested and granted. ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- How to run multiple instances of snort inline and daq and multiple interfaces (firewall) Stanford Prescott (Mar 28)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) Stanford Prescott (Mar 29)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) wkitty42 (Mar 29)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) James Lay (Mar 29)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) Jack Pepper (Mar 29)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) Stanford Prescott (Mar 29)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) Stanford Prescott (Mar 29)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) wkitty42 (Mar 29)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) Stanford Prescott (Mar 30)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) Ward Sladek (Mar 30)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) Stanford Prescott (Mar 30)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) James Lay (Mar 30)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) Stanford Prescott (Mar 30)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) wkitty42 (Mar 29)
- Re: How to run multiple instances of snort inline and daq and multiple interfaces (firewall) Stanford Prescott (Mar 29)