Suricata Interface Rules on Bridged Interfaces
-
I was curious, since i've setup a bridge for two interfaces, and called it VirSWPort with Eth2 and Eth3, when I create a rule for VirSWPort, do I still need to do it for each individual port namely eth2 and eth3 or is it implied that whatever rule I put on virswport, is applied to eth2 & 3?
-
Probably depends how you have Suricata configured.
Usually the only reason you run it on the internal interface is to have visibility on the internal IPs in which case running it on the bridge would give you that.
If you're running in-line mode you probably need to use the real interfaces.
If you're running blocking mode the bridge filtering probably determines where it needs to be run.
It's not a common deployment so I would recommend running some tests to see what works for you.
Steve
