Lists

This tab configures various types of lists which can be used by Snort Interface instances.

To create a new list, change the tab on the left to the type of list to add, then click in the toolbox. To edit an existing list, click on its row. To delete a list, click on its row.

Address Lists

Address lists are simple collections of IP addresses and subnets for the IP Reputation preprocessor. These lists can also be used for purposes such as custom Home and External networks.

Name

The name of the address list.

Contents

IP address and subnet entries, one per line.

Pass Lists

Pass Lists are lists of IP addresses that Snort should never block. When an IP address is listed on a Pass List and that list is used for the External Net on a Snort interface, for example, Snort will never insert a block for addresses in that pass list even when it detects malicious traffic on that interface.

Name

The name of the pass list.

Description

A longer text description of the pass last.

Auto-generated IP Addresses

Optional groups of addresses automatically gathered internally by the Snort package to populate pass lists.

Local Networks

All networks directly attached to interfaces on this device, excluding networks on WAN interfaces.

WAN Gateways

IP addresses of gateways associated with WAN interfaces.

WAN DNS Servers

External upstream DNS servers.

Virtual IPs

Virtual IP addresses configured on this device.

VPN Addresses

Networks and IP addresses associated with configured VPN instances.

Aliases

Pass lists can automatically include content from Firewall Aliases instead of defining them manually in the package.

Firewall aliases to include

Drop-down/checkbox control to select Firewall Aliases to include in the pass list.

Custom Addresses List

This section is a list of manually-defined addresses or networks to include in the pass list.

Click Add to create a new entry. Click next to an entry to remove it from the list.

IP/CIDR

IP address or CIDR masked network/prefix to include in the list. One per entry.

Warning

Defining a pass list alone is not sufficient to prevent Snort from blocking hosts. The pass list must also be selected in a Snort 3 interface instance as the Home Net or External Net.

Suppression Lists

Suppression Lists control the alerts generated by Snort rules. When a rule in a list suppresses an alert, then Snort no longer logs an alert entry or blocks the IP address when a that rule is matched. Snort still inspects all network traffic against the rule, but even when traffic matches the rule signature, it will not generate an alert.

Note

This is different from disabling a rule. When a rule is disabled, Snort no longer tries to match it to any network traffic.

Suppressing a rule gives more fine-grained control, such as the ability to stop alerts for a specific rule based on a source or destination IP address. For example, these lists make it possible to suppress a specific alert when traffic from a particular trusted IP address is the source. If any other IP address is the source or destination of the traffic, the rule may still be desired. Additionally, it allows that IP address to trigger other alerts rather than passing all traffic from that host.

Tip

To eliminate all alerts from a rule, it is more efficient to disable the rule rather than suppress it. Disabling the rule will remove it from the list of match rules in Snort and therefore lessens the workload for Snort.

Tip

It is usually easier and faster to add suppress list entries by clicking the icon on an alert entry.

Name

The name of the suppression list.

Description

A longer text description of the suppression last.

Text Suppression Rules

Items to suppress expressed in plain text format, for example:

suppress gen_id 1, sig_id 2109876, track by_src, ip 192.0.2.10
suppress gen_id 1, sig_id 2023456

Lua suppression script

Items to suppress expressed in Lua table format, for example:

suppress = {
    { gid = 1, sid = 2109876, track = 'by_src', ip = '192.0.2.10' },
    { gid = 1, sid = 2023456 },
}