In that case you want to use two interfaces, see details described in 15. Setting up IPS/inline for Linux — Suricata 8.0.0-dev documentation unless you want to do it via netfilter nfqueue, see 15. Setting up IPS/inline for Linux — Suricata 8.0.0-dev documentation
1 Like