Skip to content

suricata HOME_NET should contain RED interfaces #5152

Closed

Description

The HOME_NET variable lists green and local networks, but it should also contain all the red networks.
Observed problem:

  1. transparent proxy on port 80
  2. ids rule like alert http $HOME_NET any -> $EXTERNAL_NET any
  3. rule can't fire because the connection goes from nethserver red to net, but nethserver red is not in $HOME_NET

Adding the red address to HOME_NET the rule fires.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    verifiedAll test cases were verified successfully

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions