The Snort package is designed with some defaults to make things easier for most situations. One of those defaults is the automatic inclusion of all firewall interface networks (other than the WAN) into HOME_NET and the default PASS LIST. Your situation is different and the defaults sound like they are not what you want.
You can fix this by creating custom Pass Lists on the PASS LIST tab. When creating them, uncheck all the "default checked" options and then only check the ones you want (or none of them). Use an Alias to contain all the addresses you want in the list.
For example, assume you want to create a custom HOME_NET on the DMZ interface. First, create an Alias under Firewall > Aliases to hold all the addresses you want in the custom HOME_NET. Remember an alias can contain other aliases (nested aliases), so you should be able to construct a single alias containing all the IP addresses you want. Next, create a custom pass list and call it maybe MY_HOME_NET or whatever. In the Pass List dialog uncheck all the default-checked options (unless there are some you want). Now select the alias you created earlier in the ADDRESS box at the bottom of the screen. Just start typing the name and it should auto-populate with matching values. Save the custom Pass List.
Now go to the Snort interface (DMZ) where you want to use the custom HOME_NET. Select the INTERFACE SETTINGS tab. Scroll down to the HOME_NET drop-down selector. Select the custom HOME_NET Pass List you created above. Save the change and then restart Snort on the interface. It will now be using that HOME_NET. You can repeat the process for custom Pass List and even a custom EXTERNAL_NET if you want.
Bill
