Snort auto-update whitelist with dynamic WAN gateway?



  • Hello,

    The subject line pretty much sums up my question.  Our WAN gateway is dynamic, so I'm wondering if Snort will automatically update it in the whitelist when it changes.

    Cheers



  • I recently added new code to both the Snort and Suricata custom blocking plugins so that an interface IP-change monitoring thread is launched when the binary is started.  The thread subscribes to FreeBSD kernel routing table messages.  When a firewall locally-connected interface IP changes, the old IP is removed from the auto-whitelist and the new IP is inserted.  I need to look again, but I don't think I was looking for and pulling out the gateway address changes.  If not, perhaps I can add that option to the new auto-whitelist feature.

    Bill



  • Wonderful.  Thank you, Bill. That would be very helpful.


Log in to reply