Consulting of snort

[calitzin]

Anyone know how to make a white list for snort?, so when you block offenders you skip the list

[bmeeks]

Snort has the capability for creating a Pass List (on the PASS LISTS tab). You can create a list and include an alias. You would define that alias within pfSense under FIREWALL > ALIASES.

Once you have your custom Pass List created, go to the Snort interface's settings edit tab and select your custom Pass List by name in the Pass List drop-down selector on that tab.

You can also use Snort's IP Reputation tab to import a plaintext file of IP addresses or networks (using the standard Snort syntax) and assign those to an IP REP whitelist. Any IP address or network defined on that list will then bypass Snort inspection completely.