Suricata on LAGG/VLAN/OpenVPN Setup

[NilsS]

I have a setup with 2 Realtek NICs that are bundled to lagg0 and used with VLANs for all traffic WAN and several internal VLANs. Additionally i route my traffic over an AIRVPN gateway group.

I would like suricata blocking bad traffic.

IPS seems to be not supported, i used pfsense before with that

lazy block list

https://forum.opnsense.org/index.php?topic=3792.msg13316#msg13316

Is this possible to implement on opnsense.

I  tried with all kind of setups for the interface WAN/VPN but also the lagg interface, with or without promiscous mode. But i can only get a few stream rules show up in the alert tab even if trigger the rules with bad traffic.

Its only for a home use, so power consumption is a high priority. Using bigger hardware with intel nics is not a solution.