Using only Custome rules
-
Hi
We are currently testing PFSENSE+Suricata only Wan/Lan interfaces
Since we will have to use it for a specific purpose only, we do not need all the rules
We just need to create our own custom one for specific ports.All rules re currently disabled
I've added as a test the following rule under the Wan interfacealert http $EXTERNAL_NET any -> any any (msg:"HTTP Connection";)
alert icmp any any -> any any (msg: "ICMP Packet found";)Once saved only the first rule in the list works, the second one is being ignored.
Is this normal behavior or is it something wrong in the rules?
Please advise
thank you
-
@w4rh0und I think it should also be icmp $External_net any -> ... this may help you: https://suricata.readthedocs.io/en/suricata-6.0.0/rule-management/adding-your-own-rules.html
