What order are rules processed when using IDS?

[allebone]

When using Intrusion Detection, what rules are processed first?

I have normal Firewall rules I would like processed before IDS is processed. Is this the default, or if not, how can I ensure my own rules are processed prior to IDS rules being processed?

Kind regards
Pete

[mimugmail]

No, first there is Suricata, then cames the Firewall. You can only flip if you let it listen to LAN instead of WAN

[allebone]

Hmm, that is disappointing. Thanks for clarifying.

[mimugmail]

IPS/netmap listens in the NIC while pf rules are processed in kernel.
It's the same as with Linux/iptables ...