<![CDATA[Snort/Suricata Suggestion]]>Hello,

One of the main feature of pfsense is the ability to use aliases, almost everywhere….and its very well done!!

On firewall:Aliases there is 4 tabs; IP, PORT, URL, ALL

It would be nice if we could add a 5th tab called: IDS

On the IDS tab we could create any meta-variables using the $ operator of Snort or Suricata.

Example : $NTP_SERVERS...

Any aliases created on this tab could be invoked by IDS rules. That would make Snort and Suricata packages even more accessible, integrate pfsense DNA of aliases and make it even more customizable.

F.

]]>https://forum.netgate.com/topic/76123/snort-suricata-suggestionRSS for NodeTue, 21 Jul 2026 01:54:45 GMTSat, 22 Nov 2014 20:25:34 GMT60<![CDATA[Reply to Snort/Suricata Suggestion on Mon, 24 Nov 2014 16:19:03 GMT]]>@fsansfil:

Hey BBcan,

I know, its really well done too…

But just wanted a simple way to add more $ operator with aliases ;)

F.

This idea would require changes within the pfSense code itself, and not just the Snort or Suricata package code.

Bill

]]>https://forum.netgate.com/post/497257https://forum.netgate.com/post/497257Mon, 24 Nov 2014 16:19:03 GMT<![CDATA[Reply to Snort/Suricata Suggestion on Mon, 24 Nov 2014 00:49:12 GMT]]>Hey BBcan,

I know, its really well done too…

But just wanted a simple way to add more $ operator with aliases ;)

F.

]]>https://forum.netgate.com/post/497183https://forum.netgate.com/post/497183Mon, 24 Nov 2014 00:49:12 GMT<![CDATA[Reply to Snort/Suricata Suggestion on Sat, 22 Nov 2014 20:35:40 GMT]]>Hi fsansfil,

This functionality already exists with both Snort and Suricata.

In each Interface, edit the Interface variables tab (ie "WAN Variables"), and enter a pre-defined pfSense Alias.

]]>https://forum.netgate.com/post/497057https://forum.netgate.com/post/497057Sat, 22 Nov 2014 20:35:40 GMT