Snort in dual-wan configuration

  • Hello,

    I have pfsense (latest snapshot), dual WAN configuration (WAN,OPT1). And Snort installed.
    If in Snort configuration I check WAN and OPT1 ("select all your WAN interfaces") then snort seems not working properly - in 'snort blocked' tab there are no IP, in 'snort alerts' there ale no alerts.

    If i check only one interface i.e. WAN - all work ok.

    Snort does'nt work with dual-wan in this way ?

  • I noticed this too.
    I'm running 1.0.1-SNAPSHOT-03-18-2007 built on Thu Mar 8 22:14:44 EST 2007.

    Running top inside a ssh shows that snort2c is running but NOT snort as it is the process that also should be there.
    Disabling OPT1(in my case+reboot) fixes the issue and snort appears inside top and you can see how snort snorts up some CPU.

  • Snort is currently limited to running on only 1 WAN interface, iirc.