[Snort-users] problem with snort inline and iptables
adamx001 at ...11827...
Fri Nov 27 14:16:29 EST 2009
I configured Snort 220.127.116.11 with --with-mysql --enable-inline on Ubuntu Linux
I made an iptables entry to pass all outgoing ICMP packets to ip_queue:
"iptables -A OUTPUT -p icmp -j QUEUE".
I started the ip_queue service using "modprobe ip_queue".
Then i started Snort using "snort -Qc *configfilelocation*".
My Snort rule is very simple: "drop icmp *myip* any -> *other_ip* any (sid:
The problem is that it seems like it ignores my Snort rule and drops all
ICMP packets, not just the ones targeted to *other_ip*.
Even if i stop running Snort, i cannot ping any ip's. Why is this happening?
Should i make a rule inside the QUEUE chain to pass back the packets to
another chain? It looks like the packets are stuck in QUEUE.
Any help appreciated,
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users