How to configure Snort for intrusion prevention?

[lleachii]

@evadon, wait..."intrusion prevention"...Snort has block capability in OpenWrt?

I thought it only alerts.

If so, can you tell us how?

@evadon

ERROR: snort.conf(326) => Invalid keyword '}' for server configuration.

What's on line 326 of the snort.conf file? Just a bracket?

@diizzy

at least 512Mbyte you're going to run into memory issues.

@slh

even 512 MB RAM is borderline.

I've ran Snort on a VM (pfSense) , perhaps I need to do more testing. I usually spin up router VMs with 256 MB. If the OP were to load a lot of rules, I'd definitely agree.