snort3 service file

snort3.service

[Unit]
Description=Snort Daemon
After=syslog.target network.target

[Service]
Type=simple
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
ExecStartPre=/usr/sbin/ip link set up promisc on arp off multicast off dev snort_iface1
ExecStartPre=/usr/sbin/ethtool -K snort_iface1 rx off tx off gro off lro off
ExecStart=/usr/local/bin/snort --plugin-path=/usr/local/lib/snort --plugin-path /usr/local/etc/so_rules/ -c /usr/local/etc/snort/snort.lua -D -u snort -g snort -l /var/log/snort -m 0x1b --create-pidfile -s 65535 -k none -i snort_iface1
Restart=on-failure
RestartSec=120s

[Install]
WantedBy=multi-user.target

Note: For users having problems with shared object rules not loading and want to just forego them entirely, remove the line --plugin-path /usr/local/etc/so_rules/.

You'll also need to re-run pulledpork, commenting out or removing the distro and sorule_path directives to avoid downloading shared-object rules. Alternatively, use snort2lua and convert the Emerging Threats ruleset from snort 2.9.x to 3.x