[Snort-users] problem with snort inline and iptables

Adam Szabo adamx001 at ...11827...
Fri Nov 27 14:16:29 EST 2009


Dear all,

I configured Snort 2.8.5.1 with --with-mysql --enable-inline on Ubuntu Linux
9.04.
I made an iptables entry to pass all outgoing ICMP packets to ip_queue:
"iptables -A OUTPUT -p icmp -j QUEUE".
I started the ip_queue service using "modprobe ip_queue".
Then i started Snort using "snort -Qc *configfilelocation*".
My Snort rule is very simple: "drop icmp *myip* any -> *other_ip* any (sid:
*my_rule_id*;)"

The problem is that it seems like it ignores my Snort rule and drops all
ICMP packets, not just the ones targeted to *other_ip*.
Even if i stop running Snort, i cannot ping any ip's. Why is this happening?
Should i make a rule inside the QUEUE chain to pass back the packets to
another chain? It looks like the packets are stuck in QUEUE.

Any help appreciated,
Adam Szabo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20091127/3aefc3cf/attachment.html>


More information about the Snort-users mailing list