[Snort-devel] snort inline mode in FreeBSD and IPFW

Nomad Esst noname.esst at ...398...
Wed Jul 3 07:35:39 EDT 2013


Hi list

I'm trying to run snort in inline mode in FreeBSD and IPFW as DAQ. But it does not drop packets. Here's my configurations:

Here is my custom snort.conf: (named snr.conf)
config daq: ipfw
config daq_mode: inline
config policy_mode: inline
output alert_full: stdout
include snort.rule
Here is a simple rule file: (name snort.rule)
drop tcp any any -> any 23 (msg: "Drop telnet packets"; sid: 1000001)
pass ip any any -> any any
And here is what I do:
snort -c /root/snr.conf -Q --alert-before-pass

And I expect the ICMP packets to pass and telnet packets to drop. But both packet types pass! Am I missing something? Or snort is buggy in FreeBSD and inline mode?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20130703/711ccea2/attachment.html>


More information about the Snort-devel mailing list