Am I configuring snort correctly to run as an IPS

I have snort running on my OpenWrt router/firewall which has two NICs:
eth0 = LAN facing
eth1 = WAN facing

My goal is to have snort running as an IPS dropping flagged packets.

I am running snort like this and the log file does show dropped matches:
 snort -q -i eth0:eth1 -c /etc/snort/snort.lua --tweaks local

I am getting confused due to some user-written documentation stating that
three not two NICs are required for this setup.

The only modifications I made to /etc/snort/snort.lua was the definitions of my
HOME_NET and EXTERNAL_NET:
HOME_NET = [[ 10.9.1.0/24 10.9.2.0/24 ]]
EXTERNAL_NET = "!$HOME_NET"

Here is my /etc/snort/local.lua:
output.logdir = '/mnt/mmcblk0p3'

snort = {}
snort["-Q"] = ''

ips = {
  mode = inline,
  variables = default_variables,
  include = RULE_PATH .. '/snort.rules',
}

daq = {
  module_dirs = {
    '/usr/lib/daq',
  },
  modules = {
    {
      name = 'afpacket',
      mode = 'inline',
    },
  },
}

alert_fast = {
  file = true,
  packet = false,
}

normalizer = {
  tcp = {
    ips = true,
  }
}

file_policy = {
  enable_type = true,
  enable_signature = true,
  rules = {
    use = {
      verdict = 'log', enable_file_type = true, enable_file_signature = true
    }
  }
}
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette