I'm testing Intrusion Detection on my OPNSense box.
When I set both WAN and LAN, the dashboard shows no more 'out' traffic.
Is this normal behavior?
Hi there,
Normally, you wouldn't set both.
We're using one Suricata instance for all traffic. Not sure what happens internally.
This is in IPS mode only, right?
Cheers,
Franco
Yes, ISP mode.
Both instances was just an experiment.
When I only set WAN the dashboard traffic shows WAN and LAN on the IN graphic, but only LAN on the OUT graphic.