intrusion detection: or maybe this... #1233

src/opnsense/service/templates/OPNsense/IDS/rc.conf.d

-{# Macro import #}
-{% from 'OPNsense/Macros/interface.macro' import physical_interface %}
 {% if helpers.exists('OPNsense.IDS.general') and OPNsense.IDS.general.enabled|default("0") == "1" %}
-suricata_enable="YES"
 suricata_opnsense_bootup_run="/usr/local/opnsense/scripts/suricata/setup.sh"
-
+suricata_enable="YES"
 {% if OPNsense.IDS.general.ips|default("0") == "1" %}
-# IPS mode, switch to netmap
-suricata_netmap=YES
-
+suricata_netmap="YES"
 {% else %}
-
 # IDS mode, pcap live mode
-{% set addFlags=[] %}
-{% for intfName in OPNsense.IDS.general.interfaces.split(',') %}
-{%   if loop.index == 1 %}
-{# enable first interface #}
-suricata_interface="{{ physical_interface(intfName) }}"
-{%   else %}
-{#   store additional interfaces to addFlags #}
-{%      do addFlags.append(physical_interface(intfName)) %}
-{%   endif %}
-{% endfor %}
-{#   append additional interfaces #}
-suricata_flags="-D --pcap {%
-   for intf in addFlags
-%} -i {{ intf }}  {% endfor
-%} "
-
-{% endif %}
-
+suricata_flags="-D --pcap"
 {% else %}
 suricata_enable="NO"
 {% endif %}

src/opnsense/service/templates/OPNsense/IDS/suricata.yaml

@@ -748,8 +748,12 @@ logging:
       format: "[%i] <%d> -- "
 
 pcap:
-  - interface: default
+  {% if helpers.exists('OPNsense.IDS.general.interfaces') %}
+    {% for intfName in OPNsense.IDS.general.interfaces.split(',') %}
+  - interface: {{physical_interface(intfName)}}
     promisc: {% if helpers.exists('OPNsense.IDS.general.promisc') and OPNsense.IDS.general.promisc|default('0') == '1' %}yes{% else %}no{% endif %} #  promiscuous mode
+    {% endfor %}
+  {% endif %}
 
 pcap-file:
   # Possible values are: