🔐 pfSense Snort Interface Security Guide
Configure Snort rules correctly for WAN, DMZ, and VLAN interfaces. Protect your server and IoT devices effectively.
🌐 WAN Interface Settings
The WAN interface is your gateway to the internet. Enable the most comprehensive IPS rules here:
- Snort GPLv2 Community Rules
- ET Open Rules
- Feodo Tracker Botnet C2 IP Rules
- Emerging Malware, Botnet, Drop, Compromised
- Emerging DoS, Scan, Web Client/Server
- Protocol Rules: DNS, HTTP, SMTP, ICMP
Auto-Flowbit Resolution should always remain enabled.
🖥️ DMZ Interface Settings
The DMZ hosts your HestiaCP server. Focus on web server-related rules:
- Snort Server Apache, MySQL, Webapp Rules
- Emerging Web Server, SQL
- Emerging Malware, Botnet, Scan
- Policy Rules: Spam, Inappropriate, Social
📡 VLAN (IoT) Interface Settings
IoT devices are often vulnerable. Use lightweight but targeted rules:
- Emerging Mobile Malware, Botnet
- Emerging Compromised, Drop
- Protocol Rules: DNS, HTTP, MQTT, ICMP
- PUA Rules: Adware, P2P
⚠️ Important Warning
emerging-exploit.rules should not be enabled as it may cause Snort service instability.
📝 Conclusion
Enable full IPS coverage on WAN, web server-focused rules on DMZ, and lightweight botnet/malware rules on VLAN for IoT devices. Manage false positives with the Suppression List and monitor logs regularly.