Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login
    Introducing Netgate Nexus: Multi-Instance Management at Your Fingertips.

    Blocked hosts from Snort

    Scheduled Pinned Locked Moved Firewalling
    3 Posts 2 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • X Offline
      xternal
      last edited by

      Does the snort package create an alias or anything for hosts currently in the blocked list? Or is it located somewhere?

      I would like to setup a firewall rule to redirect internal blocked hosts to a website indicating why they have been blocked and to contact an IT member.

      Cheers

      1 Reply Last reply Reply Quote 0
      • BBcan177B Offline
        BBcan177 Moderator
        last edited by

        Snort and Suricata populate the "snort2c" file which can be seen in the Table Viewer in Diagnostics I believe.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • X Offline
          xternal
          last edited by

          How do you reference these tables in firewall rules. Some of them are aliases which is ok, but the others are not like snort2c.

          Is there an easy way to get say squidguard to read the snort2c table and redirect any hosts to an error page?

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2026 Rubicon Communications LLC (Netgate). All rights reserved.
          Privacy Policy · Cookie Policy