[Snort-users] trouble with online mode

Sec_Aficionado secaficionado at ...11827...
Sat Dec 13 16:02:33 EST 2014

---- quoted message follows ----
Ah....yea that's the issue. With --daq-mode inline snort will create it's own bridge (that you have no control over). This type of deployment works really well as having snort on it's own machine inline such as: (Internet) <-> (SnortIPS) <-> (LinuxRouter) <-> (Switch) I think you and I were in the same boat where we had a linux router that we wanted to put IPS on. You can use the nfq daq functionality like so:

snort -Q -D --daq nfq --daq-var device=eth0 --daq-var queue=1 -c /usr/local/etc/snort/snort.conf /sbin/iptables -t nat -I PREROUTING -j NFQUEUE --queue-num 1 or /sbin/iptables -I INPUT -j NFQUEUE --queue-num 1 

But I'm going to be honest...I never got nfq to work well. There's a thread on the list that talks heavily about this, but in a nutshell as soon as a packet hits the snort queue, it is either dropped as an IPS hit, or accepted and sent along, which means any iptables rules AFTER the snort queue rule are not referenced, so be warned and make sure to nmap the external IP after you make the changes. It really seems like the IPS functionality is more suited for the IPS on it's own dedicated machine and not integrated into a router. My two cents :) James

---- end of quoted message ---- 


I wonder if you ever got this setup to work. I found the following suggestions in a suricata configuration guide. They use FORWARD instead of INPUT. I have to do some reading before I test this but I'd like to know if you have any advice.

I would really like to get snort to work as an IPS in a firewall/router box, rather than in a separate machine.


The following is an excerpt from: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux

There is also a way to use iptables with multiple networks (and interface cards). Example:

sudo iptables -I FORWARD -i eth0 -o eth1 -j NFQUEUE sudo iptables -I FORWARD -i eth1 -o eth0 -j NFQUEUE
The options -i (input) -o (output) can be combined with all previous mentioned options

If you would stop Suricata and use internet, the traffic will not come through. To make internet work correctly, you have to erase all iptable rules.

Sent from my mobile
Any weird stuff is autocorrect's fault
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20141213/7b3479a4/attachment.html>

More information about the Snort-users mailing list