Home / server / Questions / 1088466
Accepted
Gill-Bates
Asked: 2021-12-30 03:32:40 +0800 CST

Do I have to enter the public IP into the HOME_NET variable?

  • 772

Do I have to enter the public IP of eth0 as HOME_NET in the suricata.yaml?

vars:
  # more specific is better for alert accuracy and performance
  address-groups:
    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"

My understanding is that only private addresses belong in the variable HOME_NET

suricata

0 Answers

  1. Best Answer

    $HOME_NET is supposed to list the IP addresses of your protected hosts/networks. It doesn't matter if these addresses are private or public.

    • 1