How to monitor the traffic from or to the firewall itself?

[abcnew]

Now I am using suricata to monitor the LAN port which has several vlans on it. If I monitor the WAN port, there will be a lot of traffic that is NATed. I am interesting in this question: how to identify the traffic of the pfSense firewall itself with suricata other than the NATed traffic?

[bmeeks]

You really can't since any traffic the firewall sends out on the WAN will naturally have the same WAN public IP as the "source" as the NAT traffic forwarded out for the LAN hosts. You could probably go diving into the states and do a lot of cross-referencing and identify firewall sourced traffic, but it would be a chore.

So basically everything Suricata sees on the WAN side that is outbound to the Internet will have as the "source IP" your WAN's public IP address.

[abcnew]

thanks for your detailed information.