# bridge-firewall on Bro

**URL:** <https://community.zeek.org/t/bridge-firewall-on-bro/354>\
**Category:** Zeek\
**Created:** [April 4, 2003, 12:17pm UTC](https://community.zeek.org/t/bridge-firewall-on-bro/354 "2003-04-04T12:17:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sylvain\_de\_Tilly](https://avatars.discourse-cdn.com/v4/letter/s/958977/32.png) [@Sylvain\_de\_Tilly](https://community.zeek.org/u/Sylvain_de_Tilly)\
**Post date:** [April 4, 2003, 12:17pm UTC](https://community.zeek.org/t/bridge-firewall-on-bro/354/1 "2003-04-04T12:17:23Z")

</div>

Hi,

I'm trying to configure a bridge-firewall with the bro IDS on it to  
check web traffic (for example). But I've some troubles. Actually, if  
I launch bro with the http rules, due to dependences I have to load  
scan rules. And the scan rules try to connect some machines... But my  
aim is to have an IDS without IP address, so without connection from  
and to the bridge.

Due to that, bro give me a lot of warnings and is very long to  
launch...

I try to modify the rules via my conf file but there are some kinds I  
don't understand. For examples, if I change the "skip\_scan\_sources" to  
an empty value after loading the scan rule (loading via http rule) ;  
bro try to resolve address before changing the value. And if I put the  
redef variable before loading the rule, Bro say me : "redef" used but  
not previously defined"...

I think there are some fundamentals thinks I don't understand but I'll  
try to.

If anybody have an idea about that or eventually a configuration file  
to give me some ideas, It could be great !

Thanks & Regards,

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/bridge-firewall-on-bro/354/2 "2022-05-06T15:36:43Z")

</div>