目前在suricata設定白名單的做法

在/etc/suricata/rules新增 pass.rules
內容如下

pass ip 10.0.0.1 any -> any any (msg:"pass all traffic from 10.0.0.1"; sid:9999999;)
pass ip 10.0.0.2 any -> any any (msg:"pass all traffic from 10.0.0.2"; sid:9999998;)

修改紅字部分
注意 sid 不可重複

在 /etc/suricata/suricata.yaml 把上面的rules引用進來

systemctl restart suricata