Snort in dual-wan configuration
-
Hello,
I have pfsense (latest snapshot), dual WAN configuration (WAN,OPT1). And Snort installed.
If in Snort configuration I check WAN and OPT1 ("select all your WAN interfaces") then snort seems not working properly - in 'snort blocked' tab there are no IP, in 'snort alerts' there ale no alerts.If i check only one interface i.e. WAN - all work ok.
Snort does'nt work with dual-wan in this way ?
-
I noticed this too.
I'm running 1.0.1-SNAPSHOT-03-18-2007 built on Thu Mar 8 22:14:44 EST 2007.Running top inside a ssh shows that snort2c is running but NOT snort as it is the process that also should be there.
Disabling OPT1(in my case+reboot) fixes the issue and snort appears inside top and you can see how snort snorts up some CPU. -
Snort is currently limited to running on only 1 WAN interface, iirc.