I'm putting Snort on a wifi router. My understanding is when in inline/blocking mode, I have to bridge a LAN interface to the WAN interface for packet inspection. If this is the case, it does not seem possible to detect/block an attack from one host to another host on the same LAN because the traffic will not go out the WAN interface.

Is this correct? If so, is there a configuration that would support detecting / blocking an attack from host to host on the same LAN?

  • If you put it inline between LAN and WAN it obviously will not see LAN-LAN traffic and thus also cannot block it. You need to put it inline between LAN and LAN for that and also make sure that traffic only flows over the router and not direct between WiFi endpoints. If and how you can do this with your unknown router is not known. Jun 25 '19 at 13:06

It depends GREATLY on the configuration of your network. To simplify this, I'll assume you're running on a flat network.

To have Snort inspect all LAN>LAN traffic inline, you would need to ensure that there are no L2 devices interconnected below the Snort device,which I'm not sure is practical.

In a normal network configuration, all inter-LAN traffic would take place at layer 2, and would never reach the Snort box, as it would never leave the layer 2 switching infrastructure.

I don't know that there is a practical way to have Snort act as an IPS on entirely LAN-based traffic unless it's in-line at layer 3 between two different LAN networks.

Probably the best solution if it is a flat network you would like to monitor would be to mirror a port on an L2 switch and send all of the traffic to Snort there, acting as an IDS. Note that it must act as an IDS in this scenario because while it can SEE the traffic because it is being mirrored to it, it cannot act on this because it is not responsible for forwarding the traffic as it would be in an L3 inline configuration.

  • Very good technical explanation and reasoning. Thanks for your help.
    – Bryan
    Jun 25 '19 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.