# Order of Operation for variables

**URL:** <https://forum.suricata.io/t/order-of-operation-for-variables/3308>\
**Category:** Help\
**Tags:** ips, suricata\
**Created:** [March 10, 2023, 6:31am UTC](https://forum.suricata.io/t/order-of-operation-for-variables/3308 "2023-03-10T06:31:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Carl\_MaGill](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/carl_magill/32/1922_2.png) [@Carl\_MaGill](https://forum.suricata.io/u/Carl_MaGill)\
**Post date:** [March 10, 2023, 6:31am UTC](https://forum.suricata.io/t/order-of-operation-for-variables/3308/1 "2023-03-10T06:31:02Z")

</div>

I have a customer that has several subnets under 172.16.0.0/16. Currently the HOME\_NET is configured with that network. Analyst at the SOC would like to take certain subnets and make them EXTERNAL\_NET. What is the order of operation regarding rule firing for HOME\_NET and EXTERNAL\_NET? Does one trump the other? I know that multiple YAML files can be created, but there are over 700 of those subnets! Thank You.

---

<div class="post-metadata">

**Author:** ![IDSTower](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/idstower/32/861_2.png) [@IDSTower](https://forum.suricata.io/u/IDSTower)\
**Post date:** [March 10, 2023, 3:04pm UTC](https://forum.suricata.io/t/order-of-operation-for-variables/3308/2 "2023-03-10T15:04:31Z")

</div>

In most of the cases it will be enough to treat anything that is not within HOME\_NET as external.  
This is achieved through negating the HOME\_NET(eg: EXTERNAL\_NET: “!$HOME\_NET”)

This however has one limitation, which is detecting lateral movement within the same network, if detecting lateral movements is not covered by other mechanisms and it is needed, you can either set external net to “any” or tune each rule individually.

---

<div class="post-metadata">

**Author:** ![Carl\_MaGill](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/carl_magill/32/1922_2.png) [@Carl\_MaGill](https://forum.suricata.io/u/Carl_MaGill)\
**Post date:** [March 15, 2023, 11:42am UTC](https://forum.suricata.io/t/order-of-operation-for-variables/3308/3 "2023-03-15T11:42:17Z")

</div>

Thank you for the answer. We will advise our Analyst.