Project

General

Profile

Support #2742

help with inline IPS

Added by jeremy d 3 months ago. Updated 9 days ago.

Status:
New
Priority:
Normal
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

Hello! I am trying to have suricata be inline and block on 2 interfaces eth0 and eth1. eth0 is my gateway and eth1 is providing DHCP downstream. I have it blocking on the external interface with the following commands, yet it only alerts on inbound going out traffic.

modprobe br_netfilter
ifconfig eth1 192.168.22.1 up
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -t mangle -j NFQUEUE --queue-bypass
echo 1 > /proc/sys/net/ipv4/ip_forward

History

#1

Updated by Victor Julien 3 months ago

  • Tracker changed from Bug to Support
  • Affected Versions deleted (4.0beta1)

I don't think the mangle table is meant for this purpose. The filter table is where the NFQUEUE rule should be.

Please see this guide https://suricata.readthedocs.io/en/suricata-4.1.0/setting-up-ipsinline-for-linux.html

#2

Updated by jeremy d 3 months ago

Victor Julien wrote:

I don't think the mangle table is meant for this purpose. The filter table is where the NFQUEUE rule should be.

Please see this guide https://suricata.readthedocs.io/en/suricata-4.1.0/setting-up-ipsinline-for-linux.html

Thanks for the help Victor! That guide is helpful if i want to make it inline, but I cant seem to also have the IPS get an IP address. I have a setup where Router/Gateway <-> Suricata (with DHCP IP) <-> Router2 (NATed IP from Suricata) but I can only get traffic from router2 outbound.

#3

Updated by jeremy d 3 months ago

This is my updated bas script I am using

modprobe br_netfilter
ifconfig eth0 0.0.0.0 up --arp
ifconfig eth1 0.0.0.0 up --arp
brctl addbr br0
brctl addif br0 eth1
brctl addif br0 eth0
brctl stp br0 off
ifconfig br0 192.168.22.1 up --arp
dnsmasq --interface=br0 --dhcp-range=br0,192.168.22.2,192.168.22.6,12h
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -I FORWARD -j NFQUEUE --queue-bypass
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
#4

Updated by jeremy d 3 months ago

So i was able to get the routing to work properly but suricata only watches and blocks on traffic when packets are leaving the LAN port and not on my WAN port with the following configs

modprobe br_netfilter
ifconfig eth0 0.0.0.0 up
ifconfig eth1 192.168.22.1 up
dnsmasq --interface=eth1 --dhcp-range=eth1,192.168.22.2,192.168.22.6,12h
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -I FORWARD -i eth0 -o eth1 -j NFQUEUE --queue-bypass
iptables -I FORWARD -i eth1 -o eth0 -j NFQUEUE --queue-bypass
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
#5

Updated by Victor Julien 9 days ago

  • Assignee set to Community Ticket

Also available in: Atom PDF