No Snort Alerts after moving behind ISP Router
-
My ISP recently forced their crappy Router/Fibermodem combo on me and I had to move my pfSense CE (Current) behind it. Now I don't get any Snort alerts.
Is this normal?The WAN interface changed from PPPoE to DHCP, and I unchecked "Block Private Networks" and "Block bogon networks" as the IP subnet their Router is providing is 192.168.10.0/24
I tried restarting Snort on that interface, but no joy.
Everything else seems to be working OK.Suggestions?
Thanks!
-
@DaHai8 Snort runs outside the firewall. So it will find packets blocked by the pfSense firewall.
Is the ISP router forwarding ports?
-
@DaHai8 said in No Snort Alerts after moving behind ISP Router:
My ISP recently forced their crappy Router/Fibermodem combo on me and I had to move my pfSense CE (Current) behind it. Now I don't get any Snort alerts.
Is this normal?You were seeing Snort alert on normal "Internet noise". That refers to the constant barrage of traffic from various nefarious sources that your pfSense firewall rules were going to block.
As stated by @SteveITS, Snort sees traffic on pfSense before the firewall rules are applied. That means when run on the WAN it would have been alerting on that noise, but your pfSense WAN interface firewall rules would block that traffic anyway. So, in effect, you had Snort chewing up CPU resources and RAM for very little or no gain as the firewall is going to block nearly all of that traffic anyway. Much better to run Snort on the firewall's internal interfaces such as the LAN and/or DMZ.
Now as to your question, "yes" Snort is still working, But the NAT feature of your ISP's router is probably hiding that traffic now as the router will have its own built-in stateful firewall.
