Suricata, Zenarmor , interfaces and vpn

[Monju0525]

I am currently using a vpn via Wireguard. It works great.
Zenarmor is assigned to the lan. What should Suricata (IDS)  be assigned to : the wan or the wireguard_interface?
Under the IDS advanced mode, do I need to modify home networks? The helps says  "Networks to interpret as local", what does that mean?

[Melroy vd Berg]

I know it's an old topic..

But I believe you should select your LAN interface only in Suricata. If not, correct me below via a reply comment.

[MojoMC]

Zenarmor is assigned to the lan. What should Suricata (IDS)  be assigned to : the wan or the wireguard_interface?

Zenarmor says: "When you use IPS & Zenarmor together, you can only use the WAN interface for Suricata."

If running Suricata on your WAN interface is a good idea, depends on your situation and your hardware ressources.

Someone on Reddit had the following experience with Suricata on WAN:
"We found that the cheapest of cheap rented DDoS attacks could overwhelm our machine because now not only were we using CPU cycles to block them with the firewall, but we were also inspecting every packet with Suricata as well. We would see CPU spikes to 99% and traffic ground to a halt. We went to LAN only, and now we only see the blips from these $20 DDoS attacks."