Hi guys
In my firewall rules, I have a chain called VIRUS and in that chain there are over 100 rules.
I want to be able to track any user whose traffic matches any of the VIRUS rules (i.e any rule in chain VIRUS)
I first taught of adding a rule to “add src to address list” but I later discovered that I will need to add this for each of the rules, which I think is not the best.
So, are there firewall matchers that will match a chain? such that any user that matches any of the VIRUS rules will be added to a particular address list for isolation.
OR
Any other idea?
Thankx in adv
THE POINT IS THAT I WANT TO ISOLATE VIRUS INFECTED USERS.