Open Information Security Foundation

05/05/2019

08:52 PM Suricata Bug #2965 (Closed): Version 5 Beta1 - Multiple NFQUEUE failed

Hi,
On 05/05/19 at 10:35, F.Tremblay wrote:
> Hello, can anyone confirm the same problem with multiple NFQUEUE ?
... Felipe Houde

07/29/2017

07:44 PM Suricata Support #2188: Suricata IPS with Bypass Switch Recommendatiton

Have you tried ?
In you suricata.service add :
[Service]
Restart=on-failure
In your iptables rule that send t... Felipe Houde

07/22/2017

04:55 PM Suricata Support #2188: Suricata IPS with Bypass Switch Recommendatiton

also check https://redmine.openinfosecfoundation.org/issues/2135 Felipe Houde

04:47 PM Suricata Support #2188: Suricata IPS with Bypass Switch Recommendatiton

Are you truly bridging or brouting ?
if truly brifging make sure you have those:
net.bridge.bridge-nf-call-arpt... Felipe Houde

04:54 PM Suricata Support #2135: Suricata IPS Inline on a bridge not working

ebtables -t broute -A BROUTING -p 0x0800 -j ACCEPT
ebtables -t broute -A BROUTING ! -p 0x0800 -j ACCEPT
ebtab... Felipe Houde

04:43 PM Suricata Support #2135: Suricata IPS Inline on a bridge not working

with some iptables rules like this:
iptables -A FORWARD -m mark ! --mark 0x1/0x1 -j NFQUEUE
iptables -A FORWA... Felipe Houde

04:39 PM Suricata Support #2135: Suricata IPS Inline on a bridge not working

nfq:
mode: accept
repeat-mark: 1
repeat-mask: 1
Shouldnt you use mode: repeat with the repeat mark/masq o... Felipe Houde