I have a firewall (Debian Stable 7.5) which works in bridged mode. The interfaces eth0
(WAN) and eth1
(LAN) are linked with the bridge interface br0
.
Can I deploy a NIDS (eg. Snort) on this server? If so, which interface should it listen on?
I believe in this case it should sniff traffic on br0
. However, if its rules don't care about source addresses and you don't want to block or alert to potential outbound intrusions (and why not?) you can most likely sniff on the WAN interface without harm.
Sniffing is passive, more or less, and just allows you to inspect everything going over an interface.