Please include the following information with your help request:
- Suricata version
- Operating system and/or Linux distribution
- How you installed Suricata (from source, packages, something else)
Hello forum I am new to suricata but I use opnsense in my office for long time, right now i use latest version of opnsense with zenarmor plugin. My requirement is I have multiple vlans and I want to block all domains in each vlan except few domains like “example.com” “example1.com” etc. and the zenarmor gives this option but in only 1vlan/interface and only for 100 devices, so I heard in internet that using suricata I can do this too but in multiple vlan using many rules and block all websites except few. So is this right?. Also another reason to use zenarmor is because it allow website even it has multiple IP and cdn’s like “whatsapp.web” or “gmail” etc. so it does blocking and allowing in layer7 instead of IP allowing or blocking. So is the suricata do this too, or it block and allows ip’s only ? Because by IP blocking or allowing the domains has multi-cdn is not working/open.
Sorry I ask this noob question I am very new to this.
If the above thing possible then any documents/tutorial links someone provide then it’s very helpful to me.
Thanks
Chris