Update 11-pf.conf

Incorporated "2stacks" Private IPs

11-pf.conf

@@ -34,10 +34,18 @@ filter {
           patterns_dir => ["/etc/logstash/conf.d/patterns"]
           match => [ "message", "%{SURICATA}"]
       }
-        if ![geoip] and [ids_src_ip] !~ /^(10\.|172\.22\.|192\.168\.)/ {
+      if ![geoip] and [src_ip] {
+        # Check if source IP address is private.
+        cidr {
+               address => [ "%{[src_ip]}" ]
+               network => [ "0.0.0.0/32", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fc00::/7", "127.0.0.0/8", "::1/128", "169.254.0.0/16", "fe80::/10", "224.0.0.0/4", "ff00::/8", "255.255.255.255/32", "::" ]
+               add_field => { "[@metadata][src_locality]" => "private" }
+        }
+        # Check to see if src_locality exists. If it doesn't the src_addr didn't match a private address space and locality must be public.
+        if ![@metadata][src_locality] {
           geoip {
             add_tag => [ "GeoIP" ]
-            source => "ids_src_ip"
+            source => "src_ip"
             database => "/etc/logstash/GeoLite2-City.mmdb"
           }
         }
@@ -48,6 +56,7 @@ filter {
           }
         }
       }
+    }
     if [prog] =~ /^charon$/ {
       mutate {
         add_tag => [ "ipsec" ]