Re: Suppress Feature

Re: Suppress Feature

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 732 bytes --]

Hello Reza,

IPFire has a whitelist feature where you can add hosts so that they won’t be blocked at all.

Is it this what you are looking for?

-Michael

> On 23 Feb 2021, at 21:59, Reza Fathi <rezafathi20032003(a)yahoo.com> wrote:
> 
> 
> Dear madam/sir,
> 
> As you might know there is a feature in pfsense called suppress list where you can add source or destination ip addresses along with a rule causing the alert to bypass it. But that is not available in ipfire. So is there any way so I can add suppress list on suricata by hand? Would you please add this feature in ipfire?. Thanks.
> 
> https://pfsense-docs.readthedocs.io/en/latest/ids-ips/snort-suppress-list.html
> 
> 
> Regards,
> Reza.

Re: Suppress Feature

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1277 bytes --]

Ah okay.

IPFire currently does not provide that functionality over the UI.

> On 24 Feb 2021, at 11:49, Reza Fathi <rezafathi20032003(a)yahoo.com> wrote:
> 
> Hello, Michael,
> 
> Yes i know the whitelist but if you see the link i provided you can suppress based on a single rule for any source or destination ip. But in whitelist if I add a host I won’t get any alert anymore.
> 
> Regards,
> Reza.
> 
> On Feb 24, 2021, at 14:39, Michael Tremer <michael.tremer(a)ipfire.org> wrote:
> 
> Hello Reza,
> 
> IPFire has a whitelist feature where you can add hosts so that they won’t be blocked at all.
> 
> Is it this what you are looking for?
> 
> -Michael
> 
>> On 23 Feb 2021, at 21:59, Reza Fathi <rezafathi20032003(a)yahoo.com> wrote:
>> 
>> 
>> Dear madam/sir,
>> 
>> As you might know there is a feature in pfsense called suppress list where you can add source or destination ip addresses along with a rule causing the alert to bypass it. But that is not available in ipfire. So is there any way so I can add suppress list on suricata by hand? Would you please add this feature in ipfire?. Thanks.
>> 
>> https://pfsense-docs.readthedocs.io/en/latest/ids-ips/snort-suppress-list.html
>> 
>> 
>> Regards,
>> Reza.
> 
>