Ability to runs snort as IPS

[gbqs]

Hi

I've just configured Netgate with snort and written some custom signatures. I've noticed that I had to enable an alert, rather than a drop and assume that this then triggers a firewall rule to drop the traffic, so the 1st packet flow that triggers the rule is permitted, then subsequent packets are blocked.

My Q is, is there any way to run snort as a pure IPS (so packets flow through and are blocked, rather than allowing the triggering packet through and then blocking the IP address).

If there is no way with Snort, would Suricata be a valid method to do this ?

Many thanks

[bmeeks]

@gbqs
Snort cannot run as a true inline IPS at this time on pfSense. Suricata can providing you have NIC hardware whose drivers fully support Netmap on FreeBSD. Not all do, so beware.