Project

General

Profile

Actions
Copy link

Support #1034

closed
LO

Help needed with proper IP block rule syntax using Suricata

Support #1034: Help needed with proper IP block rule syntax using Suricata

Added by Lambert Osas over 12 years ago. Updated over 12 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

Hi, I have setup Suricata sometime ago and I intend to use it to block inbound & outbound connection to malicious IPs. Suricata is properly setup and running and has been configured to rule an IP block rule with some sample rules as follows:

drop ip [XXX.XXX.XXX.XXX] any -> $HOME_NET any (msg:"Bad IP Reputation"; reference:url,www.spamhaus.org/drop/drop.lasso; threshold: type limit, track by_dst, seconds 3600, count 1; classtype:misc-attack; flowbits:set,ET.Evil; flowbits:set,ET.DROPIP; sid:24040000; rev:2307;)

Where; XXX.XXX.XXX.XXX is the IP to be blocked.

The problem is that although suricata was able to load the rule file, the rule is not working. I can still connect to the blocked IP. Please can someone help me review this rule syntax and tell me what might be wrong with it?

Thanks

Actions
Copy link

Also available in: PDF Atom