Run pfsense infront of another router for only the snort capability

  • I wanted to know if it's possible to put pfsense infront of another router only for the snort functionality.  I would want to put pfsense in a "transparent mode" or make it so it allows all traffic both ways.  Not act as a packet filter.  What I am trying to get at is I need to keep my ASAs in place, but I want an easy to use snort or some type of IPS/IDS infront of them.  I like the snort gui in pfsense and it's easy to use for me.  Any ideas on how this would work or other IDS/IPS products that are easy to use with a gui?  I assume I would want to use bypass nics? Any help is appreciated. Thanks.

  • You can a bridge between 2 interfaces and Snort will see this as seperate interfaces and act as it is in "transparant mode". I did use this once to implement it quickly without the hassle of routing changes and other inconveniences.

    I use routed interfaces in production.

  • So you went away from this.  How did you configure the bridge? Any details?  This is new to me. Thanks.

Log in to reply