PfSense Suricata on physical & vlan interface?

virtit · August 25, 2018, 3:24am

Hello! I have a novice question.

I have PfSense running and Suricata enabled. However, I have added/configured VLANs and was wondering if I need to have Suricata running on the physical interface as well as the VLAN interface or just on the physical interface?

Thanks for you time!

Dexter_Kane · August 25, 2018, 3:37am

Neither, you run it on the pfsense interfaces. Really you only need to run it on WAN but you can run it on other interfaces too if you really want to.

oO.o · August 25, 2018, 4:26am

+1

You will probably get a lot of false positives if you run it on anything other than WAN.

Dynamic_Gravity · August 25, 2018, 6:55am

Also, don’t forget to set a file size limit for the log file, or it will fill your system.