Suricata

Victor Julien wrote:

I don't think the mangle table is meant for this purpose. The filter table is where the NFQUEUE rule should be.

Please see this guide https://suricata.readthedocs.io/en/suricata-4.1.0/setting-up-ipsinline-for-linux.html

Thanks for the help Victor! That guide is helpful if i want to make it inline, but I cant seem to also have the IPS get an IP address. I have a setup where Router/Gateway <-> Suricata (with DHCP IP) <-> Router2 (NATed IP from Suricata) but I can only get traffic from router2 outbound.

This is my updated bas script I am using

modprobe br_netfilter
    ifconfig eth0 0.0.0.0 up --arp
    ifconfig eth1 0.0.0.0 up --arp
    brctl addbr br0
    brctl addif br0 eth1
    brctl addif br0 eth0
    brctl stp br0 off
    ifconfig br0 192.168.22.1 up --arp
    dnsmasq --interface=br0 --dhcp-range=br0,192.168.22.2,192.168.22.6,12h
    iptables -F
    iptables -X
    iptables -t nat -F
    iptables -t nat -X
    iptables -t mangle -F
    iptables -t mangle -X
    iptables -I FORWARD -j NFQUEUE --queue-bypass
    echo 1 > /proc/sys/net/ipv4/ip_forward
    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

So i was able to get the routing to work properly but suricata only watches and blocks on traffic when packets are leaving the LAN port and not on my WAN port with the following configs

modprobe br_netfilter
    ifconfig eth0 0.0.0.0 up
    ifconfig eth1 192.168.22.1 up
    dnsmasq --interface=eth1 --dhcp-range=eth1,192.168.22.2,192.168.22.6,12h
    iptables -F
    iptables -X
    iptables -t nat -F
    iptables -t nat -X
    iptables -t mangle -F
    iptables -t mangle -X
    iptables -I FORWARD -i eth0 -o eth1 -j NFQUEUE --queue-bypass
    iptables -I FORWARD -i eth1 -o eth0 -j NFQUEUE --queue-bypass
    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    echo 1 > /proc/sys/net/ipv4/ip_forward

You could try to set dedicated queue numbers (--queue-num) and attach suricata to both. You could also test with suricata running on only one of those if both NFQUEUE jump targets really work.