Using only Custome rules

w4rh0und

Hi

We are currently testing PFSENSE+Suricata only Wan/Lan interfaces
Since we will have to use it for a specific purpose only, we do not need all the rules
We just need to create our own custom one for specific ports.

All rules re currently disabled
I've added as a test the following rule under the Wan interface

alert http $EXTERNAL_NET any -> any any (msg:"HTTP Connection";)
alert icmp any any -> any any (msg: "ICMP Packet found";)

Once saved only the first rule in the list works, the second one is being ignored.

Is this normal behavior or is it something wrong in the rules?

Please advise

thank you

NollipfSense

@w4rh0und I think it should also be icmp $External_net any -> ... this may help you: https://suricata.readthedocs.io/en/suricata-6.0.0/rule-management/adding-your-own-rules.html