luci-app-snort

luci-app-snort is a complete LuCI frontend for administering Snort 3 on OpenWrt 24.x and newer. It uses LuCI JavaScript views, UCI-backed configuration, rpcd/ubus service actions, and a procd init script so Snort can be configured and operated without editing raw configuration files.

This project is completely vibecoded.

Features

• Dashboard with runtime state, version, uptime, interface, mode, rule count, alerts today, CPU and RAM usage
• Start, stop, restart and reload controls through rpcd
• UCI-backed general, logging and performance configuration
• Automatic Snort config generation from UCI
• Rule category inventory, enable or disable controls and local rule editing
• Community Rules and ET Open import helpers
• Live alerts view with filters for priority, SID, interface and IP
• Log browser for fast.log, eve.json and alert_json

Package Layout

luci-app-snort/
  Makefile
  README.md
  htdocs/luci-static/resources/snort/
  htdocs/luci-static/resources/view/snort/
  po/
  root/etc/config/snort
  root/etc/init.d/snort
  root/usr/libexec/snort/
  root/usr/share/luci/menu.d/
  root/usr/share/rpcd/acl.d/
  root/usr/share/rpcd/ucode/

Dependencies

• OpenWrt 24.x or newer
• snort3
• rpcd
• ucode
• luci-base
• curl
• jq
• ca-bundle

Installation

Install the package into an OpenWrt buildroot like any other LuCI application.

In a feed checkout

1. Copy luci-app-snort/ into your custom feed or into feeds/luci/applications/.
2. Run ./scripts/feeds update -a.
3. Run ./scripts/feeds install luci-app-snort.
4. Enable LuCI -> Applications -> luci-app-snort in make menuconfig.

On a running system

Build the package first and install it with opkg install luci-app-snort_*.ipk.

Build

Example build steps inside an OpenWrt tree:

make package/luci-app-snort/compile V=s

Or for a full image build:

make menuconfig
make -j$(nproc)

Configuration

After installation, open LuCI and navigate to Services -> Snort.

General Settings

• Enable service state
• Select the monitored interface
• Define HOME_NET and EXTERNAL_NET
• Switch between IDS and IPS mode
• Toggle promiscuous and inline operation
• Set snaplen
• Enable or disable logging

Logging

• fast.log
• alert_json
• eve.json

Performance

• Threads
• Memory hint
• Packet buffer size

Rules

• Review imported .rules files
• Toggle category activation, stored in UCI
• Edit custom rules in the local rules file
• Search installed rules by SID or free text
• Import Snort Community Rules
• Import Emerging Threats Open Rules

Generated Runtime Config

The package generates a runtime configuration under /var/etc/snort/ based on UCI settings.

• Snort 3 defaults to /var/etc/snort/snort.lua
• Validation uses snort -T -c ...

Status API

The rpcd namespace is luci.snort and provides JSON payloads for:

• status
• start
• stop
• restart
• reload
• stats
• rules
• alerts
• logs
• validate

Security Notes

• JavaScript never executes privileged commands directly
• Write actions go through rpcd ACLs only
• Helper scripts shell-quote user input before command invocation
• Rule content and log output are treated as data, not executed code
• Configuration values are validated in the LuCI form and again during runtime config generation

Troubleshooting

Snort does not start

• Check Services -> Snort -> Dashboard
• Use Validate Generated Config on the configuration page
• Inspect /tmp/snort-validate.err
• Inspect the init script log with logread -e snort

No rules are shown

• Confirm that your rules directory exists
• Re-import Community Rules or ET Open Rules
• Verify that the router has DNS and outbound HTTPS access

No alerts are visible

• Ensure logging is enabled in the LuCI configuration
• Confirm that fast.log is being written to the configured log directory
• Reload rules after changing categories or local rules

License

AGPL-3.0-only. See LICENSE.