How can I make a local only bridged interface using the IP utility for SNORT?
1
vote
0
answers
195
views
I am trying to use the Snort IPS. In order to use it as an inline prevention system I need to make two interfaces and snort will bridge the two to apply its rules as a packet passes through the bridge. My issue however comes when I actually make a bridge between the interfaces. I have to make another virtual interface to bridge with my physical one and I have been using the dummy interface option of the ip command to do this, but I don't know if that's the right way to make a usable virtual interface. However, when I do this and bridge the two outside of snort to test connectivity, I lose all connection to the external network. Here's what Ive tried:
sudo ip link add name eth1 type dummy
sudo ip link add name br0 type bridge
sudo ip link set wlp0s20f3 master br0
sudo ip link set eth1 master br0
After this, I assign them all unclaimed ip addresses and mac addresses then bring them all up
sudo ip link set dev eth1 up
sudo ip link set dev br0 up
Full disclosure, I've never done networking on Linux and will take any assistance you could give, even if I have to do this completely differently.
Asked by l3m0n
(11 rep)
Dec 2, 2022, 03:01 AM