IDS, what interface to choose

[ejvl]

Hi,
I've the following situation.

- A router from my provider, LAN is 192.168.1.1
- From this router, one cable is connected to my switch. I've configured this switchport untagged in VLAN 100.
- From the switch, another cable is connected to my Nuc with OpnSense installed. This switchport is untagged 1 and tagged 100.
- In OpnSense I've created a vlan 100 interface and set my WAN to this interface.
- My WAN in OpnSense is a 192.168.1.x address, my LAN is 10.0.0.254.
- My OpnSense WAN 192.168.1.x is configured as DMZ in the router of the provider so all the incoming traffic and ports are directly send to OpnSense.
- My home network is in 10.0.0.x with the 10.0.0.254 (Opnsense) as default gateway.

Now I want enable IDS and later IPS. Rules are activated but in this specific situation, with interface I should choose? WAN or LAN?

Thanks.