Suricata on just a VLAN?

[Patrick M. Hausen]

Hi folks,

just a quick question: my setup is all VLANs on top of a lagg on top of a pair of Intel ix(4). Can I run Suricata on just one VLAN interface? I would like to experiment with it.

Thanks,
Patrick

[Vilhonator]

Yes it is possible.

On web gui, go to Services ---> Administration and on the interface selection, choose the VLAN interface you want to use IDS/IPS on, check promiscuous mode and enable boxes and click apply.

Otherwise it is pretty much the same as if setting it up for all interfaces.

[Patrick M. Hausen]

I'll give that a try, thank you.

I was a bit unsure about that because the documentation states:
https://docs.opnsense.org/manual/ips.html

Interfaces: Interfaces to protect. When in IPS mode, this need to be real interfaces supporting netmap. (when using VLAN's, enable IPS on the parent)

Worst case I can apply the $HOME_NET parameter. Reason being that my OPNsense is not my Internet facing firewall but I would like to move my publically reachable servers behind it and activate IDS just for these.