Changing $HOME_NET in Snort
-
Excuse my stupidity, but how do I change $HOME_NET in Snort (2.9.2.3, pkg 2.5.1)? I've searched this forum and the answer seems to be 'use firewall aliases'. Well, I have quite a number of aliases defined under Firewall:Aliases, but when I open Snort configuration to configure settings for some interface, all that appears in the 'Home net' dropdown is 'default'.
This is on pfSense 2.0.1, which was migrated from 1.2.3 running on older hardware and older version of Snort by way of restoring old configuration on the new system, but I have already removed and re-installed Snort (not preserving Snort configuration).