Suricata - Divert (IPS)

[Mario_Rossi]

In my opinion, two much-appreciated improvements would be to write an in-depth guide for each individual field in this window.
You cannot view this attachment.

Another thing I didn't find was a list of what each individual ruleset does. The name isn't self-explanatory, clicking Edit doesn't provide any useful information, and I couldn't find a comprehensive description on the rule writer's website.
You cannot view this attachment.

[Mario_Rossi]

I did some research and testing on my installation.
I posted the results in this thread on my forum: https://hwtweakers.net/forum/viewtopic.php?t=48471
I know, it's in Italian, but I know that with Google Translate, it shouldn't be a problem anymore.

If it could be useful to the community, you could copy/translate/paste and integrate the official guides.
It's not exactly a super detailed guide from scratch, and I've overlooked several steps, but it should still be helpful.

[nero355]

I posted the results in this thread on my forum: https://hwtweakers.net/forum/viewtopic.php?t=48471
I know, it's in Italian, but I know that with Google Translate, it shouldn't be a problem anymore.

You could ofcourse also post it in the Italian sub-forum here : https://forum.opnsense.org/index.php?board=22.0 :)

[mic]

Hello,

in case of Destination NAT (formerly Port Forward), where should I configure divert-to? I think in the rule associated with the Destination NAT rule, which must be created manually on the WAN interface?

Thank you

Michele

[Gorpes]

Hi @Monviech,

I have a follow-up question regarding Divert mode.

My setup is:

- One WAN and one LAN
- Zenarmor is enabled on the LAN interface
- Suricata is running in Divert (IPS) mode
- On LAN I added a Pass + divert-to Intrusion Detection rule (Source: LAN net, Destination: any) above the default "Allow LAN to any" rule.

Everything works as expected:

- Zenarmor inspects the traffic.
- Suricata generates alerts and blocks traffic when configured.
- Traffic matching the divert rule never reaches the default "Allow LAN to any" rule, which I understand is expected.

Is this considered a valid and recommended configuration for a simple home network?

Or would you recommend a different placement of the "divert-to" rule?

Also, is running Zenarmor on LAN together with a "divert-to" rule on the same interface a supported configuration?

Thank you!