Intrusion Detection

[Tripple_Delta]

I'm testing Intrusion Detection on my OPNSense box.
When I set both WAN and LAN, the dashboard shows no more 'out' traffic.
Is this normal behavior?

[franco]

Hi there,

Normally, you wouldn't set both.

We're using one Suricata instance for all traffic. Not sure what happens internally.

This is in IPS mode only, right?


Cheers,
Franco

[Tripple_Delta]

Yes, ISP mode.
Both instances was just an experiment.
When I only set WAN the dashboard traffic shows WAN and LAN on the IN graphic, but only LAN on the OUT graphic.