Posted by Gnomad on Mar 07, 2016; 3:54am
URL: https://itus.accessinnov.com/Snort-rules-info-tp221p318.html

Since I'm in Router mode, I'm considering making the edit

ipvar HOME_NET [192.168.100.0/24,10.1.1.0/24,10.10.10.0/24]

 where 192.168 is the subnet of my modem, 10.1.1 is my access point (wifi router), and 10.10.10.10 is of course the Shield.

Similarly then, I should be able to change

ipvar EXTERNAL_NET any

 to

ipvar EXTERNAL_NET !$HOME_NET

Any issues anyone can spot?
Should I be treating the modem subnet as external too?