Is it possible with V5 to create a snortsam/tripwire like timed ban based on a snort rule?
My end goal would be to organise my external ip's as follows:
router ip 1
snort trip ip 2
astaro ip 3
since virtually all scans etc start from the router ip and scan up the idea is that they hit the trip and are then banned.
You could also create a rule to say listen to port 0, 21, 80 on the external int of astaro as well although in the past i have had problems with this kind of things.
POssible? INteresting?
Cheers,
Mark
This thread was automatically locked due to age.
