Suricata

 0 0 NFQUEUE all -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0

The first 2 0's mean no traffic is matching this iptables rule, so nothing is sent to Suricata.

Hi,
I moved directing to NFQUEUE on top, so iptables commands are in this sequences:

sudo iptables -F
sudo iptables -A FORWARD -j NFQUEUE
sudo iptables -t nat -A POSTROUTING -o enp0s25 -j MASQUERADE
sudo iptables -A FORWARD -i enp0s25 -o enp17s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i enp17s0 -o enp0s25 -j ACCEPT

so status: sudo iptables -vnL
Chain INPUT (policy ACCEPT 3247 packets, 1733K bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
2258 203K NFQUEUE all -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0
0 0 ACCEPT all -- enp0s25 enp17s0 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT all -- enp17s0 enp0s25 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 3198 packets, 378K bytes)
pkts bytes target prot opt in out source destination

This way, I was getting the proper drops based on configuration to drop PINGof certain IP address.
rule is:
drop icmp 192.168.10.100 any -> any any (msg:"DROP test ICMP ping from 192.168.2.106";icode:0; itype:8; classtype:trojan-activity; sid:99999999; rev:1;)

But problem now is client PC can not see internet router. So client PC can not access internet.

Regards,
Fuad

Hi,
I got everything working by replacing the command:

sudo iptables -A FORWARD -j NFQUEUE

with

sudo iptables -A FORWARD -t mangle -j NFQUEUE

The mangle table provided the proper routing.

Regards,
Fuad