Snort mailing list archives
Re: Re: Inline IP_Forwarding and other simple questions?
From: "mdpeters" <michael.peters () lazarusalliance com>
Date: Thu, 30 Dec 2004 09:50:02 -0500
I am trying to set up Snort-inline. When I enable "config layer2resets:" it dies. Do I need to include the MAC of the bridge group, in my case, 00:04:23:AD:ED:BA to get it to reset connections with IPTABLES?
config layer2resets: 00:04:23:AD:ED:BA eth0 00:04:23:AD:ED:BA eth1 00:04:23:AD:ED:BB br0 00:04:23:AD:ED:BAAlso, concerning rules for Snort-inline. Do I take to rules included in the tarball and modify the *.rules to something like this:
drop icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS Pinger"; itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; classtype:attempted-recon; sid:465; rev:3;)
orsdrop icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS Pinger"; itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; classtype:attempted-recon; sid:465; rev:3;)
orreject icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS Pinger"; itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; classtype:attempted-recon; sid:465; rev:3;)
ordrop icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ICMP ISS Pinger"; itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; classtype:attempted-recon; sid:465; rev:3;)
or something like these? Thanks, Michael----- Original Message ----- From: "Will Metcalf" <william.metcalf () gmail com>
To: "Michael D. Peters" <mdpeters () lazarusalliance com>Cc: "mdpeters" <michael.peters () lazarusalliance com>; <snort-users () lists sourceforge net>
Sent: Tuesday, December 28, 2004 6:16 PM Subject: [Snort-users] Re: Inline IP_Forwarding and other simple questions?
What I am asking is since this uses IPTABLES, should I just set up permanent "firewall type" IPTABLE rules and then use the modified snort rules to takecare of the resets, drops, etc?Yes On Tue, 28 Dec 2004 18:02:12 -0500, Michael D. Peters <mdpeters () lazarusalliance com> wrote:What I am asking is since this uses IPTABLES, should I just set up permanent "firewall type" IPTABLE rules and then use the modified snort rules to takecare of the resets, drops, etc? Will Metcalf writes:>> If I have something like this: <GATEWAY-ROUTER> connected to >> <FIREWALL> >> connected to <SNORT_INLINE> connected to <NETWORK HUB OR SWITCH>. >> Would I>> set the "var HOME_NET any" to "var HOME_NET nnn.nnn.nnn.nnn/xx? > > Yes > >> Do I need to make a startup script for IPTABLE rules or do I rely on>> drop.rules or both? I'm inclined to think that the firewall rules will >> be>> essentially duplicated with IPTABLES and the drop.rules interactively >> supplement the IPTABLES. > > I'm not really sure what you are asking for here...... Usually it is > a good idea to have a couple of iptables rules to check state for tcp > state etc. Just off the top of my head..... > > iptables -P FORWARD DROP > iptables -A FORWARD -p tcp --syn -m state --state NEW -j QUEUE> iptables -A FORWARD -p tcp -m state --state RELATED,ESTABLISHED -j > QUEUE> iptables -A FORWARD -p udp -j QUEUE > iptables -A FORWARD -p icmp -j QUEUE > >>Would MySQL logging be done the same way for Snort-inline as it is with >>regular Snort? >>>>output database: alert, mysql, dbname=snort user=snortuser >>host=localhost>>password=snortuserpassword > > Yes > > Regards, > > Will > > > > > On Tue, 28 Dec 2004 10:58:28 -0500, mdpeters > <michael.peters () lazarusalliance com> wrote:>> Concerning the snort-inline.conf file, are the "var" statements >> relevant? >> Should I specify the network and subnet that the snort-inline box runs >> on?>>>> If I have something like this: <GATEWAY-ROUTER> connected to >> <FIREWALL> >> connected to <SNORT_INLINE> connected to <NETWORK HUB OR SWITCH>. >> Would I>> set the "var HOME_NET any" to "var HOME_NET nnn.nnn.nnn.nnn/xx? >> >> Do I need to make a startup script for IPTABLE rules or do I rely on>> drop.rules or both? I'm inclined to think that the firewall rules will >> be>> essentially duplicated with IPTABLES and the drop.rules interactively >> supplement the IPTABLES. >> >> Thank you for the continued education and assistance. :) >> >> ----- Original Message ----- >> From: "Will Metcalf" <william.metcalf () gmail com> >> To: "mdpeters" <michael.peters () lazarusalliance com> >> Sent: Monday, December 27, 2004 12:04 PM>> Subject: Re: [Snort-users] Inline IP_Forwarding and other simple >> questions?>> >> > because, you are not pulling traffic off of the bridge. You are>> > pulling traffic out of iptables, via the QUEUE target. As far as >> > the>> > rules go, you need to convert alert to drop/sdrop/reject. >> > >> > Regards, >> > >> > Will >> > >> > >> > On Mon, 27 Dec 2004 11:36:10 -0500, mdpeters >> > <michael.peters () lazarusalliance com> wrote:>> >> One instance for both interfaces or just one like you wrote? How >> >> does it>> >> know what interface the bridge is on? >> >> >> >> >> >> ----- Original Message ----- >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> To: "mdpeters" <michael.peters () lazarusalliance com> >> >> Sent: Monday, December 27, 2004 11:00 AM >> >> Subject: Re: [Snort-users] Inline IP_Forwarding and other simple >> >> questions? >> >> >> >> > look at inline readme file under doc in your source. >> >> > >> >> > you were close.... >> >> > >> >> > /opt/snort/bin/snort-inline -Q -l /var/log/snort/ -D -c >> >> > /opt/snort/etc/snort_inline.conf >> >> > >> >> > something like that... >> >> > >> >> > Regards, >> >> > >> >> > Will >> >> > >> >> > >> >> > On Mon, 27 Dec 2004 09:46:33 -0500, mdpeters >> >> > <michael.peters () lazarusalliance com> wrote: >> >> >> Right now I have this running: >> >> >> >> >> >> /opt/snort/bin/snort-inline -Q -c /opt/snort/etc/inline1.conf -i >> >> >> eth1 -l >> >> >> /var/log/snort-inline1 -D >> >> >> /opt/snort/bin/snort-inline -Q -c /opt/snort/etc/inline2.conf -i >> >> >> eth2 -l >> >> >> /var/log/snort-inline2 -D >> >> >> >> >> >> I apparently do not understand how inline works. >> >> >>>> >> >> What would the snort-inline command be to work on a transparent >> >> >> bridge>> >> >> snort-inline with iptables? >> >> >> >> >> >> Where can I read up? >> >> >> >> >> >> I appreciate your help! >> >> >> >> >> >> ----- Original Message ----- >> >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> >> To: "mdpeters" <michael.peters () lazarusalliance com> >> >> >> Sent: Monday, December 27, 2004 8:14 AM >> >> >> Subject: Re: [Snort-users] Inline IP_Forwarding and other simple >> >> >> questions? >> >> >> >> >> >> > neither you would use the -Q switch to tell snort to read from>> >> >> > ip_queue. Then you have to send traffic to snort with >> >> >> > iptables with>> >> >> > a >> >> >> > rule like this. >> >> >> > >> >> >> > iptables -A FORWARD -j QUEUE >> >> >> > >> >> >> > >> >> >> > On Mon, 27 Dec 2004 00:06:30 -0500, mdpeters >> >> >> > <michael.peters () lazarusalliance com> wrote: >> >> >> >> Would I need to use the bridge "br0" group interface or the >> >> >> >> individual >> >> >> >> interfaces "eth0' and "eth1" that make up the group for the >> >> >> >> Snort-inline >> >> >> >> start command? >> >> >> >> >> >> >> >> Thanks, >> >> >> >> Michael >> >> >> >> >> >> >> >> ----- Original Message ----- >> >> >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> >> >> To: "Matt Kettler" <mkettler () evi-inc com> >> >> >> >> Cc: "mdpeters" <michael.peters () lazarusalliance com>; >> >> >> >> <snort-users () lists sourceforge net> >> >> >> >> Sent: Thursday, December 23, 2004 4:43 PM>> >> >> >> Subject: Re: [Snort-users] Inline IP_Forwarding and other >> >> >> >> simple>> >> >> >> questions? >> >> >> >>>> >> >> >> > Well said, except that drop does not reset the connection. >> >> >> >> > Using>> >> >> >> > reject will drop and reset the connection. >> >> >> >> > >> >> >> >> > Regards, >> >> >> >> > >> >> >> >> > Will >> >> >> >> > >> >> >> >> > On Thu, 23 Dec 2004 15:21:37 -0500, Matt Kettler >> >> >> >> > <mkettler () evi-inc com> >> >> >> >> > wrote: >> >> >> >> >> At 02:04 PM 12/23/2004, mdpeters wrote:>> >> >> >> >> >Do I need to enable ip_forwarding on for the transparent >> >> >> >> >> >bridge>> >> >> >> >> >to >> >> >> >> >> >work? >> >> >> >> >> >> >> >> >> >> As I understand it, you explicitly MUST NOT enable >> >> >> >> >> ip_forwarding, >> >> >> >> >> otherwise >> >> >> >> >> your snort-inline is a "pass all". >> >> >> >> >> >> >> >> >> >> >>> >> >> >> >> >Do I need to install ebtables for inline to disrupt >> >> >> >> >> >traffic or>> >> >> >> >> >is >> >> >> >> >> >iptables, libnet, and libpcap all that I might need? >> >> >> >> >>>> >> >> >> >> AFAIK you don't need ebtables. You do need libipq for >> >> >> >> >> inline>> >> >> >> >> and >> >> >> >> >> libnet.>> >> >> >> >> This is how snort-inline attaches to iptables by using >> >> >> >> >> libipq>> >> >> >> >> instead >> >> >> >> >> of >> >> >> >> >> using libpcap. >> >> >> >> >> >> >> >> >> >>>> >> >> >> >> > It is my impression that iptables just firewalls with >> >> >> >> >> > static>> >> >> >> >> > rules. >> >> >> >> >>>> >> >> >> >> On it's own, yes, but IPTables is VERY extensible via >> >> >> >> >> libipq..>> >> >> >> >>>> >> >> >> >> That's where snort-inline comes in. Snort-inline interacts >> >> >> >> >> with>> >> >> >> >> iptables. >> >> >> >> >> It doesn't do things like create iptables rules to block >> >> >> >> >> packets, >> >> >> >> >> it >> >> >> >> >> the>> >> >> >> >> whole system becomes an iptables rule, it just happens to >> >> >> >> >> be a>> >> >> >> >> rule >> >> >> >> >> that >> >> >> >> >> runs snort instead of some simple expression. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >>> >> >> >> >> >Do the snort rules running on the transparent inline >> >> >> >> >> >snort box>> >> >> >> >> >reset >> >> >> >> >> >the >> >> >> >> >> >traffic that passes through using inline? >> >> >> >> >>>> >> >> >> >> Depends on if you use DROP or SDROP :).. However, inline >> >> >> >> >> doesn't>> >> >> >> >> JUST >> >> >> >> >> reset>> >> >> >> >> the traffic.. it also prevents the packet from being >> >> >> >> >> forwarded>> >> >> >> >> at >> >> >> >> >> all. >> >> >> >> >> DROP >> >> >> >> >> will also reset, SDROP won't. >> >> >> >> >>>> >> >> >> >> Snort 2.3's inline capacity is a direct port of >> >> >> >> >> snort-inline.>> >> >> >> >> You >> >> >> >> >> might >> >> >> >> >> want to check their FAQ for other info: >> >> >> >> >> >> >> >> >> >> http://snort-inline.sourceforge.net/FAQ.html >> >> >> >> >> >> >> >> >> >> ------------------------------------------------------- >> >> >> >> >> SF email is sponsored by - The IT Product Guide>> >> >> >> >> Read honest & candid reviews on hundreds of IT Products >> >> >> >> >> from>> >> >> >> >> real >> >> >> >> >> users.>> >> >> >> >> Discover which products truly live up to the hype. Start >> >> >> >> >> reading>> >> >> >> >> now. >> >> >> >> >> http://productguide.itmanagersjournal.com/ >> >> >> >> >> _______________________________________________ >> >> >> >> >> Snort-users mailing list >> >> >> >> >> Snort-users () lists sourceforge net >> >> >> >> >> Go to this URL to change user options or unsubscribe: >> >> >> >> >> https://lists.sourceforge.net/lists/listinfo/snort-users >> >> >> >> >> Snort-users list archive: >> >> >> >> >> http://www.geocrawler.com/redir-sf.php3?list=snort-users >> >> >> >> >> >> >> >> >> > >> >> >> >> > >> >> >> >> > ------------------------------------------------------- >> >> >> >> > SF email is sponsored by - The IT Product Guide>> >> >> >> > Read honest & candid reviews on hundreds of IT Products >> >> >> >> > from real>> >> >> >> > users.>> >> >> >> > Discover which products truly live up to the hype. Start >> >> >> >> > reading>> >> >> >> > now. >> >> >> >> > http://productguide.itmanagersjournal.com/ >> >> >> >> > _______________________________________________ >> >> >> >> > Snort-users mailing list >> >> >> >> > Snort-users () lists sourceforge net >> >> >> >> > Go to this URL to change user options or unsubscribe: >> >> >> >> > https://lists.sourceforge.net/lists/listinfo/snort-users >> >> >> >> > Snort-users list archive: >> >> >> >> > http://www.geocrawler.com/redir-sf.php3?list=snort-users >> >> >> >> > >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> >> >> >> >> > >> >> >> >> >> > >> >> Best regards, Michael D. Peters Director of Security Services CISSP Lazarus Alliance Inc. M: 502-767-3448 O: 502-231-8017 x8 H: 502-231-6923 F: 502-231-5347 michael.peters () lazarusalliance com www.lazarusalliance.com Verify here: http://wwwkeys.us.pgp.net------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Inline IP_Forwarding and other simple questions? mdpeters (Dec 23)
- Re: Inline IP_Forwarding and other simple questions? Matt Kettler (Dec 23)
- Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 23)
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Re: Inline IP_Forwarding and other simple questions? mdpeters (Dec 28)
- Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 28)
- Message not available
- Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 28)
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Dec 30)
- Re: Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 30)
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Dec 30)
- Message not available
- Message not available
- Message not available
- Message not available
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Dec 31)
- Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 23)
- Re: Inline IP_Forwarding and other simple questions? Matt Kettler (Dec 23)
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Re: Inline IP_Forwarding and other simple questions? mdpeters (Dec 28)
- Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 28)
- Message not available
- Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 28)