<![CDATA[Snort LAN interface assignment]]>I don't know if this is of concern also. My Lan interface assignment to snort only detects the destination as the firewall and not listing the Wan IP it is trying to access after this update. Prior to the update most often listed the LAN and the WAN and did not list the firewall as the destinations.

Has anyone else noticed this?

]]>https://forum.netgate.com/topic/183220/snort-lan-interface-assignmentRSS for NodeSun, 19 Jul 2026 00:09:21 GMTThu, 05 Oct 2023 02:28:02 GMT60<![CDATA[Reply to Snort LAN interface assignment on Thu, 05 Oct 2023 22:38:20 GMT]]>@JonathanLee said in Snort LAN interface assignment:

So should I move it to wan side because of no access to inline mode?

No, not in my view. And Inline Mode or not Inline Mode has zero bearing on where you should run the IDS/IPS.

@JonathanLee said in Snort LAN interface assignment:

Do you know what official negate appliance supports inline mode?

Any of their non-Marvel switched ports appliances. Examples include SG-5100, SG-6100, SG-8200, and a few others. Look at the list of netmap compatible devices I posted earlier.

]]>https://forum.netgate.com/post/1128606https://forum.netgate.com/post/1128606Thu, 05 Oct 2023 22:38:20 GMT<![CDATA[Reply to Snort LAN interface assignment on Thu, 05 Oct 2023 22:32:05 GMT]]>@bmeeks So should I move it to wan side because of no access to inline mode? My current config can see the xbox wan side addresses.

Do you know what official negate appliance supports inline mode?

]]>https://forum.netgate.com/post/1128604https://forum.netgate.com/post/1128604Thu, 05 Oct 2023 22:32:05 GMT<![CDATA[Reply to Snort LAN interface assignment on Thu, 05 Oct 2023 22:30:19 GMT]]>@JonathanLee said in Snort LAN interface assignment:

Is there a way to see the NAT or where the lan clients want to go after the firewall?

No, look at the other posts where I have posted the diagrams of how network traffic flows when using one of the IDS/IPS packages. The IDS/IPS sits directly between the physical NIC and the rest of the operating system kernel. It can't see anything beyond what is contained in the packet as it comes off the NIC (or from the operating system network stack on the way to the physical NIC).

It has no idea, nor any way to find out, what the operating system's network stack does with the packets.

]]>https://forum.netgate.com/post/1128603https://forum.netgate.com/post/1128603Thu, 05 Oct 2023 22:30:19 GMT<![CDATA[Reply to Snort LAN interface assignment on Thu, 05 Oct 2023 22:25:14 GMT]]>@bmeeks

Screenshot 2023-10-05 at 3.23.59 PM.png

They all show traversal to the proxy or firewall IP.

Is there a way to see the NAT or where the lan clients want to go after the firewall?

]]>https://forum.netgate.com/post/1128602https://forum.netgate.com/post/1128602Thu, 05 Oct 2023 22:25:14 GMT<![CDATA[Reply to Snort LAN interface assignment on Thu, 05 Oct 2023 13:14:42 GMT]]>Show a screen capture of what you are talking about. What you posted is not clear. What do you mean by WAN IP? Do you mean the literal public IP address assigned to your firewall, or do you really mean an external IP (as in totally outside your local networks)?

]]>https://forum.netgate.com/post/1128497https://forum.netgate.com/post/1128497Thu, 05 Oct 2023 13:14:42 GMT