[Snort-users] problem with snort inline and iptables

Adam Szabo adamx001 at ...11827...
Fri Nov 27 14:16:29 EST 2009

Dear all,

I configured Snort with --with-mysql --enable-inline on Ubuntu Linux
I made an iptables entry to pass all outgoing ICMP packets to ip_queue:
"iptables -A OUTPUT -p icmp -j QUEUE".
I started the ip_queue service using "modprobe ip_queue".
Then i started Snort using "snort -Qc *configfilelocation*".
My Snort rule is very simple: "drop icmp *myip* any -> *other_ip* any (sid:

The problem is that it seems like it ignores my Snort rule and drops all
ICMP packets, not just the ones targeted to *other_ip*.
Even if i stop running Snort, i cannot ping any ip's. Why is this happening?
Should i make a rule inside the QUEUE chain to pass back the packets to
another chain? It looks like the packets are stuck in QUEUE.

Any help appreciated,
Adam Szabo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20091127/3aefc3cf/attachment.html>

More information about the Snort-users mailing list