Project

General

Profile

Actions

Support #3225

closed

Bypass feature

Added by Dan Collins over 4 years ago. Updated about 2 years ago.

Status:
Closed
Priority:
Low
Assignee:
Affected Versions:
Label:

Description

I want to setup a bypass rule for any traffic going out from my local network.

Would this work? (This is just an example)
alert tcp $EXTERNAL_NET [0:1023] -> $HOME_NET any (msg:"TCP out bypass"; bypass; sid:9900001; rev:1;)
And is bypass better for performance than...
pass tcp $EXTERNAL_NET [0:1023] -> $HOME_NET any (msg:"TCP Ports"; sid:9900001; rev:1;)

Do I understand correctly the bypass feature will turn any TCP rule into a bypass rule by adding 'bypass' to the argument? I cannot find any rule examples of the bypass feature anywhere.

My ultimate goal is for performance. Any help or suggestions is appreciated.

Actions

Also available in: Atom PDF