Hi all,
My wan use pppoe to get a public ipv4, services are port forwarded to dmz subnet.
I got suricata enabled for a while. I have <wan ip>/32,<dmz net>/24 defined as homenet.
If I enable ips on dmz, traffic pass or block as rules defined. But transfer from dmz will slow down because packet inspect.
If I enable ips only on wan, no alter at all. But transfer from dmz will be full speed.
Here is my question:
Threats usually come from wan then pass to dmz. Why enable ips only on wan not block anything or alert anything.
Thanks for any help,