pfsense:suricata:create_a_custom_home_net
This is an old revision of the document!
Table of Contents
PFSense - Suricata - Create a custom HOME_NET
You have to first create a Pass List on the PASS LIST tab. Then on the INTERFACE SETTINGS tab for the interface you want to set a custom HOME_NET for, choose the Pass List you created in the drop-down (the one that probably says “default” right now).
Create a Firewall Alias
Navigate to Firewall → Aliases.
- Put all the remote networks and IP addresses (excepting locally-attached addresses on the firewall itself) that you want to be in HOME_NET in that alias.
TIP: Remember that on pfSense you can nest aliases (so you can put an alias in another alias).
Create a Suricata Passlist
Navigate to Services → Suricata → Pass Lists.
- Click Add.
- Name the list something with HOME_NET in it just to help you identify it in the future.
- You probably want to leave all the defaults in the new list, and then down at the bottom in the Address text box start typing the name of the alias created earlier. The alias name should auto-populate.
- Save the new Pass List.
Apply Passlist
Navigate to Services → Suricata → Interfaces.
- Select the specific Interfave you want to modify.
In Networks Suricata Should Inspect and Protect:
- Pass List: Click the drop-down and select the Pass List you created earlier.
- Click Save.
- Restart Suricata on the interface.
References
pfsense/suricata/create_a_custom_home_net.1611059831.txt.gz · Last modified: 2021/01/19 12:37 by peter