" method="post" enctype="multipart/form-data" name="iform" id="iform"> '; if($savemsg) { print_info_box_np2("{$savemsg}"); }else{ print_info_box_np2(' The Snort configuration has changed and snort needs to be restarted on this interface.
You must apply the changes in order for them to take effect.
'); } } ?>

' . "\n"; echo '' . "\n"; echo ' ' . "\n"; if (!file_exists("/var/run/snort_conf_{$snort_uuid}_.dirty")) { echo ' Snort Interfaces ' . "\n"; } echo " If Settings \n"; /* hide user tabs when no settings have be saved */ if ($config['installedpackages']['snortglobal']['rule'][$id]['interface'] != '') { if (!file_exists("/var/run/snort_conf_{$snort_uuid}_.dirty")) { echo " Categories \n"; echo " Rules \n"; echo " Servers \n"; echo " Preprocessors \n"; echo " Barnyard2 \n"; } } echo ' ' . "\n"; echo '' . "\n"; ?>

General Settings Interface   // care with spaces if ($pconfig['enable'] == "on") $checked = checked; $onclick_enable = "onClick=\"enable_change(false)\">"; echo " \n\n"; ?> Interface 'WAN', 'lan' => 'LAN'); for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) { $interfaces['opt' . $i] = $config['interfaces']['opt' . $i]['descr']; } foreach ($interfaces as $iface => $ifacename): ?> > Choose which interface this rule applies to. Hint: in most cases, you'll want to use WAN here. Description You may enter a description here for your reference (not parsed). Memory Performance 'AC-BNFA', 'lowmem' => 'LOWMEM', 'ac-std' => 'AC-STD', 'ac' => 'AC', 'ac-banded' => 'AC-BANDED', 'ac-sparsebands' => 'AC-SPARSEBANDS', 'acs' => 'ACS'); foreach ($interfaces2 as $iface2 => $ifacename2): ?> > Lowmem and ac-bnfa are recommended for low end systems, Ac: high memory, best performance, ac-std: moderate memory,high performance, acs: small memory, moderateperformance, ac-banded: small memory,moderate performance, ac-sparsebands: small memory, high performance. Choose the networks snort should inspect and whitelist. Home net default "; foreach ($hlist_select as $value): $hid += 1; if ($config['installedpackages']['snortglobal']['whitelist']['item'][$hid]['snortlisttype'] == 'netlist') { $ilistname = $config['installedpackages']['snortglobal']['whitelist']['item'][$hid]['name']; $whitelist_uuid = $config['installedpackages']['snortglobal']['whitelist']['item'][$hid]['uuid']; if ($ilistname == $hlist_sub[0]){ echo ""; }else{ echo ""; } echo htmlspecialchars($ilistname) . ' '; } endforeach; ?> Choose the home net you will like this rule to use.  Note: Default home net adds only local networks. Hint: Most users add a list of friendly ips that the firewall cant see. External net default "; foreach ($exlist_select as $value): $exid += 1; if ($config['installedpackages']['snortglobal']['whitelist']['item'][$exid]['snortlisttype'] == 'netlist') { $ilistname = $config['installedpackages']['snortglobal']['whitelist']['item'][$exid]['name']; $whitelist_uuid = $config['installedpackages']['snortglobal']['whitelist']['item'][$exid]['uuid']; if ($ilistname == $exlist_sub[0]){ echo ""; }else{ echo ""; } echo htmlspecialchars($ilistname) . ' '; } endforeach; ?> Choose the external net you will like this rule to use.  Note: Default external net, networks that are not home net. Hint: Most users should leave this setting at default. Block offenders onClick="enable_change(false)"> Checking this option will automatically block hosts that generate a Snort alert. Whitelist default "; foreach ($wlist_select as $value): $wid += 1; if ($config['installedpackages']['snortglobal']['whitelist']['item'][$wid]['snortlisttype'] == 'whitelist') { $ilistname = $config['installedpackages']['snortglobal']['whitelist']['item'][$wid]['name']; $whitelist_uuid = $config['installedpackages']['snortglobal']['whitelist']['item'][$wid]['uuid']; if ($ilistname == $wlist_sub[0]){ echo ""; }else{ echo ""; } echo htmlspecialchars($ilistname) . ' '; } endforeach; ?> Choose the whitelist you will like this rule to use.  Note: Default whitelist adds only local networks. Suppression and filtering default "; foreach ($slist_select as $value): $sid += 1; $ilistname = $config['installedpackages']['snortglobal']['suppress']['item'][$sid]['name']; $suppress_uuid = $config['installedpackages']['snortglobal']['suppress']['item'][$sid]['uuid']; if ($ilistname == $slist_sub[0]){ echo ""; }else{ echo ""; } echo htmlspecialchars($ilistname) . ' '; endforeach; ?> Choose the suppression or filtering file you will like this rule to use.  Note: Default option disables suppression and filtering. Choose the types of logs snort should create. Send alerts to main System logs onClick="enable_change(false)"> Snort will send Alerts to the Pfsense system logs. Log to a Tcpdump file onClick="enable_change(false)"> Snort will log packets to a tcpdump-formatted file. The file then can be analyzed by an application such as Wireshark which understands pcap file formats. WARNING: File may become large. Log Alerts to a snort unified2 file onClick="enable_change(false)"> Snort will log Alerts to a file in the UNIFIED2 format. This is a requirement for barnyard2. Arguments here will be automatically inserted into the snort configuration. Advanced configuration pass through <?=htmlspecialchars($pconfig['configpassthru']);?>   Note: Please save your settings before you click start.