Can the 2100 run snort and pfblocker?
-
Can the netgate 2100 run snort and pfblocker for a typical home network? Or does this hardware not have enough resources?
-
@jose24576 Yes however for the logging part of snort you will want to make sure you are using an SSD for your boot device.
-
@jose24576 It can depend on your Internet speed. Mine can get at least to 340 Mbps (my ISP limited speed) with Snort, with the few rulesets I had enabled, but I would not expect to get anywhere near 1 Gbps.
On a home network you probably need way fewer rules, for instance you're probably not running a web or mail server. And note that Snort can't inspect encrypted packets. So for my home I was only blocking (and therefore, logging) a couple packets per week, and ended up just disabling Snort the other day. Our office and data center of course log way more blocks.
The 2100 has enough RAM (4GB) to use a RAM disk, though you'll want to ensure you have enough space that the Snort and pfBlocker logs don't fill it up. I believe I have mine set to 256M for /tmp and 512M for /var and have plenty of space. The RAM disk only uses up memory that it's actually using.
pfBlocker can use a chunk of RAM depending on how many feeds are loaded, using DNSBL, etc. Plenty of free RAM on mine how I have it set up.
-
Yeah, I would not recommend using RAM disks with Snort/Suricata. It can be made to work but they do not expect to see RAM disks.
4GB is enough to run Snort/Suricata and pfBlocker. Though, as stated, it will reduce the maximum throughput.Steve
