Snort mailing list archives
Re: Re: Inline IP_Forwarding and other simple questions?
From: "mdpeters" <michael.peters () lazarusalliance com>
Date: Tue, 4 Jan 2005 08:01:28 -0500
I can get the rules to log all traffic using this:
alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg: "test tcp connections";)
alert udp $HOME_NET any <> $EXTERNAL_NET any (msg: "test udp connections";)
alert icmp $HOME_NET any <> $EXTERNAL_NET any (msg: "test icmp
connections";)
I see things getting logged. What I don't have is anything getting through
to the other side. This box should just transparently bridge the traffic
through but I'm at a loss why it is not at the moment.
++++++++++++++++++++++++++++++++++++++++
#/sbin/lsmod
Module Size Used by
ipt_state 5504 2
ip_conntrack 30348 1 ipt_state
ipv6 214624 16
iptable_filter 6016 1
ip_tables 18048 2 ipt_state,iptable_filter
bridge 32024 0
ip_queue 11672 0
autofs4 15488 0
sunrpc 110280 1
e1000 73356 0
e100 30852 0
mii 7552 1 e100
sg 32288 0
microcode 10400 0
dm_mod 37536 0
button 8472 0
battery 10892 0
asus_acpi 12440 0
ac 7308 0
ext3 108136 2
jbd 50328 1 ext3
ata_piix 9348 3
libata 33536 1 ata_piix,[permanent]
sd_mod 20352 4
scsi_mod 97224 3 sg,libata,sd_mod
++++++++++++++++++++++++++++++++++++++++
var HOME_NET is the same network that the inline interfaces are bridging.
++++++++++++++++++++++++++++++++++++++++
This is my bridge setup:
/sbin/modprobe ip_queue
/sbin/ifconfig eth1 0.0.0.0
/sbin/ifconfig eth2 0.0.0.0
/usr/local/sbin/brctl addbr br0
/usr/local/sbin/brctl addif br0 eth1
/usr/local/sbin/brctl addif br0 eth2
/sbin/ifconfig br0 up
/usr/local/sbin/brctl stp br0 off
/usr/local/sbin/iptables -F FORWARD
/usr/local/sbin/iptables -A FORWARD -j QUEUE
/sbin/ifconfig br0 0.0.0.0 -arp
++++++++++++++++++++++++++++++++++++++++
This is what my iptables setup looks like.
/usr/local/sbin/iptables -P FORWARD DROP
/usr/local/sbin/iptables -A FORWARD -p tcp --syn -m state --state NEW -j
QUEUE
/usr/local/sbin/iptables -A FORWARD -p tcp -m state --state
RELATED,ESTABLISHED -j QUEUE
/usr/local/sbin/iptables -A FORWARD -p udp -j QUEUE
/usr/local/sbin/iptables -A FORWARD -p icmp -j QUEUE
#/usr/local/sbin/iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy DROP)
target prot opt source destination
QUEUE all -- anywhere anywhere
QUEUE tcp -- anywhere anywhere tcp
flags:SYN,RST,ACK/SYN state NEW
QUEUE tcp -- anywhere anywhere state
RELATED,ESTABLISHED
QUEUE udp -- anywhere anywhere
QUEUE icmp -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
++++++++++++++++++++++++++++++++++++++++
Kernel linux-2.6.5-1.358, Fedora Core 2.
++++++++++++++++++++++++++++++++++++++++
# /sbin/ifconfig -a
eth0 Link encap:Ethernet HWaddr 00:11:11:50:EE:D2
inet addr:172.16.200.211 Bcast:172.16.255.255 Mask:255.255.0.0
inet6 addr: fe80::211:11ff:fe50:eed2/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:77160 errors:5 dropped:0 overruns:0 frame:5
TX packets:38287 errors:0 dropped:0 overruns:0 carrier:3
collisions:2126 txqueuelen:1000
RX bytes:7950909 (7.5 Mb) TX bytes:14485654 (13.8 Mb)
eth1 Link encap:Ethernet HWaddr 00:04:23:AD:ED:BA
inet6 addr: fe80::204:23ff:fead:edba/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:413 errors:0 dropped:0 overruns:0 frame:0
TX packets:673 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:31654 (30.9 Kb) TX bytes:71099 (69.4 Kb)
Base address:0xc800 Memory:ff8c0000-ff8e0000
eth2 Link encap:Ethernet HWaddr 00:04:23:AD:ED:BB
inet6 addr: fe80::204:23ff:fead:edbb/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:10067 errors:0 dropped:0 overruns:0 frame:0
TX packets:190 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:741428 (724.0 Kb) TX bytes:16514 (16.1 Kb)
Base address:0xcc00 Memory:ff8e0000-ff900000
eth3 Link encap:Ethernet HWaddr 00:04:23:AD:ED:D6
inet6 addr: fe80::204:23ff:fead:edd6/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:398 (398.0 b)
Base address:0xc000 Memory:ff780000-ff7a0000
eth4 Link encap:Ethernet HWaddr 00:04:23:AD:ED:D7
inet6 addr: fe80::204:23ff:fead:edd7/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1429283 errors:1835 dropped:0 overruns:0 frame:1835
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:307722248 (293.4 Mb) TX bytes:398 (398.0 b)
Base address:0xc400 Memory:ff7a0000-ff7c0000
eth5 Link encap:Ethernet HWaddr 00:04:23:AD:ED:A8
inet6 addr: fe80::204:23ff:fead:eda8/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:164 errors:0 dropped:0 overruns:0 frame:0
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:11008 (10.7 Kb) TX bytes:398 (398.0 b)
Base address:0xb800 Memory:ff640000-ff660000
eth6 Link encap:Ethernet HWaddr 00:04:23:AD:ED:A9
inet6 addr: fe80::204:23ff:fead:eda9/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9078 errors:0 dropped:0 overruns:0 frame:0
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:898198 (877.1 Kb) TX bytes:398 (398.0 b)
Base address:0xbc00 Memory:ff660000-ff680000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:107 errors:0 dropped:0 overruns:0 frame:0
TX packets:107 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:14503 (14.1 Kb) TX bytes:14503 (14.1 Kb)
br0 Link encap:Ethernet HWaddr 00:04:23:AD:ED:BA
inet6 addr: fe80::204:23ff:fead:edba/64 Scope:Link
UP BROADCAST RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:9861 errors:0 dropped:0 overruns:0 frame:0
TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:506916 (495.0 Kb) TX bytes:210 (210.0 b)
sit0 Link encap:IPv6-in-IPv4
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
++++++++++++++++++++++++++++++++++++++++
Am I missing something? What about a crossover cable between the firewall
ethernet interface and the snort-inline ethernet interface?
Thanks, Michael----- Original Message ----- From: "Will Metcalf" <william.metcalf () gmail com>
To: "mdpeters" <michael.peters () lazarusalliance com> Sent: Thursday, December 30, 2004 2:15 PMSubject: Re: [Snort-users] Re: Inline IP_Forwarding and other simple questions?
using a 2.6 kernel????? change config checksum_mode: all to config checksum_mode: none let me know if that fixes your problem On Thu, 30 Dec 2004 13:07:13 -0500, mdpeters <michael.peters () lazarusalliance com> wrote:var IPS_NET 65.89.128.128/27 var EXTERNAL_NET any var SMTP_SERVERS any var TELNET_SERVERS any var HTTP_SERVERS any var SQL_SERVERS any var HTTP_PORTS 80 var SHELLCODE_PORTS !80 var ORACLE_PORTS 1521 config checksum_mode: all var RULE_PATH /opt/snort-inline/rules/ips config layer2resets: 00:04:23:AD:ED:BA preprocessor flow: stats_interval 0 hash 2 preprocessor stream4: disable_evasion_alerts,iptablesnewmark,iptablesestmark,forceiptstate preprocessor stream4_reassemble: both # preprocessor clamav: ports all !22 !443, toclientonly, dbdir /usr/share/clamav preprocessor http_inspect: global iis_unicode_map unicode.map 1252preprocessor http_inspect_server: server default profile all ports { 80 80808180 } oversize_dir_length 500 preprocessor rpc_decode: 111 32771 preprocessor bo preprocessor telnet_decode output alert_full: snort-full output alert_fast: snort-fast output alert_syslog: LOG_AUTH LOG_ALERToutput database: alert, mysql, user=user password=userpassword dbname=snorthost=localhost sensor_name=INLINE output log_tcpdump: tcpdump.log include classification.config include reference.config include $RULE_PATH/ips.rules ----- Original Message ----- From: "Will Metcalf" <william.metcalf () gmail com> To: "mdpeters" <michael.peters () lazarusalliance com> Sent: Thursday, December 30, 2004 12:53 PM Subject: Re: [Snort-users] Re: Inline IP_Forwarding and other simple questions? > send me a sanitized version of your snort.conf. > > Regards, > > Will > > > On Thu, 30 Dec 2004 12:40:56 -0500, mdpeters > <michael.peters () lazarusalliance com> wrote: >> I tried the "config layer2resets: 00:04:23:AD:ED:BA" instead of the >> "config >> layer2resets:" which seems to work. >> >> >> ----- Original Message ----- >> From: "Will Metcalf" <william.metcalf () gmail com> >> To: "mdpeters" <michael.peters () lazarusalliance com> >> Cc: "Michael D. Peters" <mdpeters () lazarusalliance com>; >> <snort-users () lists sourceforge net> >> Sent: Thursday, December 30, 2004 11:06 AM >> Subject: Re: [Snort-users] Re: Inline IP_Forwarding and other simple >> questions? >> >> > Just for grins try to leave the default in there and see if it still >> > dies. if it does send me a core dump. >> > >> > Regards, >> > >> > Will >> > >> > >> > On Thu, 30 Dec 2004 09:50:02 -0500, mdpeters >> > <michael.peters () lazarusalliance com> wrote: >> >> I am trying to set up Snort-inline. When I enable "config >> >> layer2resets:" >> >> it >> >> dies. Do I need to include the MAC of the bridge group, in my case, >> >> 00:04:23:AD:ED:BA to get it to reset connections with IPTABLES? >> >> >> >> config layer2resets: 00:04:23:AD:ED:BA >> >> >> >> eth0 00:04:23:AD:ED:BA >> >> eth1 00:04:23:AD:ED:BB >> >> br0 00:04:23:AD:ED:BA >> >>>> >> Also, concerning rules for Snort-inline. Do I take to rules >> >> included>> >> in >> >> the >> >> tarball and modify the *.rules to something like this: >> >>>> >> drop icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS >> >> Pinger";>> >> itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; >> >> classtype:attempted-recon; sid:465; rev:3;) >> >> >> >> or >> >>>> >> sdrop icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS >> >> Pinger";>> >> itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; >> >> classtype:attempted-recon; sid:465; rev:3;) >> >> >> >> or >> >>>> >> reject icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS >> >> Pinger";>> >> itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; >> >> classtype:attempted-recon; sid:465; rev:3;) >> >> >> >> or >> >>>> >> drop icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ICMP ISS >> >> Pinger";>> >> itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; >> >> classtype:attempted-recon; sid:465; rev:3;) >> >> >> >> or something like these? >> >> >> >> Thanks, >> >> >> >> Michael >> >> >> >> ----- Original Message ----- >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> To: "Michael D. Peters" <mdpeters () lazarusalliance com> >> >> Cc: "mdpeters" <michael.peters () lazarusalliance com>; >> >> <snort-users () lists sourceforge net> >> >> Sent: Tuesday, December 28, 2004 6:16 PM >> >> Subject: [Snort-users] Re: Inline IP_Forwarding and other simple >> >> questions? >> >>>> >> >> What I am asking is since this uses IPTABLES, should I just set >> >> >> up>> >> >> permanent>> >> >> "firewall type" IPTABLE rules and then use the modified snort >> >> >> rules>> >> >> to >> >> >> take >> >> >> care of the resets, drops, etc? >> >> > >> >> > Yes >> >> > >> >> > >> >> > On Tue, 28 Dec 2004 18:02:12 -0500, Michael D. Peters >> >> > <mdpeters () lazarusalliance com> wrote:>> >> >> What I am asking is since this uses IPTABLES, should I just set >> >> >> up>> >> >> permanent>> >> >> "firewall type" IPTABLE rules and then use the modified snort >> >> >> rules>> >> >> to >> >> >> take >> >> >> care of the resets, drops, etc? >> >> >> >> >> >> >> >> >> Will Metcalf writes: >> >> >>>> >> >> >> If I have something like this: <GATEWAY-ROUTER> connected >> >> >> >> to>> >> >> >> <FIREWALL> >> >> >> >> connected to <SNORT_INLINE> connected to <NETWORK HUB OR >> >> >> >> SWITCH>. >> >> >> >> Would I>> >> >> >> set the "var HOME_NET any" to "var HOME_NET >> >> >> >> nnn.nnn.nnn.nnn/xx?>> >> >> > >> >> >> > Yes >> >> >> > >> >> >> >> Do I need to make a startup script for IPTABLE rules or do I >> >> >> >> rely >> >> >> >> on >> >> >> >> drop.rules or both? I'm inclined to think that the firewall >> >> >> >> rules >> >> >> >> will >> >> >> >> be >> >> >> >> essentially duplicated with IPTABLES and the drop.rules >> >> >> >> interactively >> >> >> >> supplement the IPTABLES. >> >> >> >>> >> >> > I'm not really sure what you are asking for here...... >> >> >> > Usually>> >> >> > it >> >> >> > is>> >> >> > a good idea to have a couple of iptables rules to check state >> >> >> > for>> >> >> > tcp >> >> >> > state etc. Just off the top of my head..... >> >> >> > >> >> >> > iptables -P FORWARD DROP >> >> >> > iptables -A FORWARD -p tcp --syn -m state --state NEW -j QUEUE >> >> >> > iptables -A FORWARD -p tcp -m state --state >> >> >> > RELATED,ESTABLISHED -j >> >> >> > QUEUE >> >> >> > iptables -A FORWARD -p udp -j QUEUE >> >> >> > iptables -A FORWARD -p icmp -j QUEUE >> >> >> >>> >> >> >>Would MySQL logging be done the same way for Snort-inline as >> >> >> >>it>> >> >> >>is >> >> >> >>with >> >> >> >>regular Snort? >> >> >> >> >> >> >> >>output database: alert, mysql, dbname=snort user=snortuser >> >> >> >>host=localhost >> >> >> >>password=snortuserpassword >> >> >> > >> >> >> > Yes >> >> >> > >> >> >> > Regards, >> >> >> > >> >> >> > Will >> >> >> > >> >> >> > >> >> >> > >> >> >> > >> >> >> > On Tue, 28 Dec 2004 10:58:28 -0500, mdpeters >> >> >> > <michael.peters () lazarusalliance com> wrote:>> >> >> >> Concerning the snort-inline.conf file, are the "var" >> >> >> >> statements>> >> >> >> relevant? >> >> >> >> Should I specify the network and subnet that the snort-inline >> >> >> >> box >> >> >> >> runs >> >> >> >> on? >> >> >> >>>> >> >> >> If I have something like this: <GATEWAY-ROUTER> connected >> >> >> >> to>> >> >> >> <FIREWALL> >> >> >> >> connected to <SNORT_INLINE> connected to <NETWORK HUB OR >> >> >> >> SWITCH>. >> >> >> >> Would I>> >> >> >> set the "var HOME_NET any" to "var HOME_NET >> >> >> >> nnn.nnn.nnn.nnn/xx?>> >> >> >> >> >> >> >> Do I need to make a startup script for IPTABLE rules or do I >> >> >> >> rely >> >> >> >> on >> >> >> >> drop.rules or both? I'm inclined to think that the firewall >> >> >> >> rules >> >> >> >> will >> >> >> >> be >> >> >> >> essentially duplicated with IPTABLES and the drop.rules >> >> >> >> interactively >> >> >> >> supplement the IPTABLES. >> >> >> >> >> >> >> >> Thank you for the continued education and assistance. :) >> >> >> >> >> >> >> >> ----- Original Message ----- >> >> >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> >> >> To: "mdpeters" <michael.peters () lazarusalliance com> >> >> >> >> Sent: Monday, December 27, 2004 12:04 PM>> >> >> >> Subject: Re: [Snort-users] Inline IP_Forwarding and other >> >> >> >> simple>> >> >> >> questions? >> >> >> >>>> >> >> >> > because, you are not pulling traffic off of the bridge. >> >> >> >> > You>> >> >> >> > are>> >> >> >> > pulling traffic out of iptables, via the QUEUE target. As >> >> >> >> > far>> >> >> >> > as >> >> >> >> > the >> >> >> >> > rules go, you need to convert alert to drop/sdrop/reject. >> >> >> >> > >> >> >> >> > Regards, >> >> >> >> > >> >> >> >> > Will >> >> >> >> > >> >> >> >> > >> >> >> >> > On Mon, 27 Dec 2004 11:36:10 -0500, mdpeters >> >> >> >> > <michael.peters () lazarusalliance com> wrote:>> >> >> >> >> One instance for both interfaces or just one like you >> >> >> >> >> wrote?>> >> >> >> >> How >> >> >> >> >> does it >> >> >> >> >> know what interface the bridge is on? >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> ----- Original Message ----- >> >> >> >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> >> >> >> To: "mdpeters" <michael.peters () lazarusalliance com> >> >> >> >> >> Sent: Monday, December 27, 2004 11:00 AM >> >> >> >> >> Subject: Re: [Snort-users] Inline IP_Forwarding and other >> >> >> >> >> simple >> >> >> >> >> questions? >> >> >> >> >> >> >> >> >> >> > look at inline readme file under doc in your source. >> >> >> >> >> > >> >> >> >> >> > you were close.... >> >> >> >> >> > >> >> >> >> >> > /opt/snort/bin/snort-inline -Q -l /var/log/snort/ -D -c >> >> >> >> >> > /opt/snort/etc/snort_inline.conf >> >> >> >> >> > >> >> >> >> >> > something like that... >> >> >> >> >> > >> >> >> >> >> > Regards, >> >> >> >> >> > >> >> >> >> >> > Will >> >> >> >> >> > >> >> >> >> >> > >> >> >> >> >> > On Mon, 27 Dec 2004 09:46:33 -0500, mdpeters >> >> >> >> >> > <michael.peters () lazarusalliance com> wrote: >> >> >> >> >> >> Right now I have this running: >> >> >> >> >> >> >> >> >> >> >> >> /opt/snort/bin/snort-inline -Q -c >> >> >> >> >> >> /opt/snort/etc/inline1.conf -i >> >> >> >> >> >> eth1 -l >> >> >> >> >> >> /var/log/snort-inline1 -D >> >> >> >> >> >> /opt/snort/bin/snort-inline -Q -c >> >> >> >> >> >> /opt/snort/etc/inline2.conf -i >> >> >> >> >> >> eth2 -l >> >> >> >> >> >> /var/log/snort-inline2 -D >> >> >> >> >> >> >> >> >> >> >> >> I apparently do not understand how inline works. >> >> >> >> >> >> >> >> >> >> >> >> What would the snort-inline command be to work on a >> >> >> >> >> >> transparent >> >> >> >> >> >> bridge >> >> >> >> >> >> snort-inline with iptables? >> >> >> >> >> >> >> >> >> >> >> >> Where can I read up? >> >> >> >> >> >> >> >> >> >> >> >> I appreciate your help! >> >> >> >> >> >> >> >> >> >> >> >> ----- Original Message ----- >> >> >> >> >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> >> >> >> >> To: "mdpeters" <michael.peters () lazarusalliance com> >> >> >> >> >> >> Sent: Monday, December 27, 2004 8:14 AM>> >> >> >> >> >> Subject: Re: [Snort-users] Inline IP_Forwarding and >> >> >> >> >> >> other>> >> >> >> >> >> simple >> >> >> >> >> >> questions? >> >> >> >> >> >> >> >> >> >> >> >> > neither you would use the -Q switch to tell snort to >> >> >> >> >> >> > read >> >> >> >> >> >> > from>> >> >> >> >> >> > ip_queue. Then you have to send traffic to snort >> >> >> >> >> >> > with>> >> >> >> >> >> > iptables with >> >> >> >> >> >> > a >> >> >> >> >> >> > rule like this. >> >> >> >> >> >> > >> >> >> >> >> >> > iptables -A FORWARD -j QUEUE >> >> >> >> >> >> > >> >> >> >> >> >> > >> >> >> >> >> >> > On Mon, 27 Dec 2004 00:06:30 -0500, mdpeters >> >> >> >> >> >> > <michael.peters () lazarusalliance com> wrote:>> >> >> >> >> >> >> Would I need to use the bridge "br0" group interface >> >> >> >> >> >> >> or>> >> >> >> >> >> >> the >> >> >> >> >> >> >> individual>> >> >> >> >> >> >> interfaces "eth0' and "eth1" that make up the group >> >> >> >> >> >> >> for>> >> >> >> >> >> >> the >> >> >> >> >> >> >> Snort-inline >> >> >> >> >> >> >> start command? >> >> >> >> >> >> >> >> >> >> >> >> >> >> Thanks, >> >> >> >> >> >> >> Michael >> >> >> >> >> >> >> >> >> >> >> >> >> >> ----- Original Message ----- >> >> >> >> >> >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> >> >> >> >> >> To: "Matt Kettler" <mkettler () evi-inc com> >> >> >> >> >> >> >> Cc: "mdpeters" <michael.peters () lazarusalliance com>; >> >> >> >> >> >> >> <snort-users () lists sourceforge net> >> >> >> >> >> >> >> Sent: Thursday, December 23, 2004 4:43 PM >> >> >> >> >> >> >> Subject: Re: [Snort-users] Inline IP_Forwarding and >> >> >> >> >> >> >> other >> >> >> >> >> >> >> simple >> >> >> >> >> >> >> questions? >> >> >> >> >> >> >> >> >> >> >> >> >> >> > Well said, except that drop does not reset the >> >> >> >> >> >> >> > connection. >> >> >> >> >> >> >> > Using >> >> >> >> >> >> >> > reject will drop and reset the connection. >> >> >> >> >> >> >> > >> >> >> >> >> >> >> > Regards, >> >> >> >> >> >> >> > >> >> >> >> >> >> >> > Will >> >> >> >> >> >> >> > >> >> >> >> >> >> >> > On Thu, 23 Dec 2004 15:21:37 -0500, Matt Kettler >> >> >> >> >> >> >> > <mkettler () evi-inc com> >> >> >> >> >> >> >> > wrote: >> >> >> >> >> >> >> >> At 02:04 PM 12/23/2004, mdpeters wrote: >> >> >> >> >> >> >> >> >Do I need to enable ip_forwarding on for the >> >> >> >> >> >> >> >> >transparent >> >> >> >> >> >> >> >> >bridge >> >> >> >> >> >> >> >> >to >> >> >> >> >> >> >> >> >work? >> >> >> >> >> >> >> >>>> >> >> >> >> >> >> >> As I understand it, you explicitly MUST NOT >> >> >> >> >> >> >> >> enable>> >> >> >> >> >> >> >> ip_forwarding, >> >> >> >> >> >> >> >> otherwise >> >> >> >> >> >> >> >> your snort-inline is a "pass all". >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >>> >> >> >> >> >> >> >> >Do I need to install ebtables for inline to >> >> >> >> >> >> >> >> >disrupt>> >> >> >> >> >> >> >> >traffic or >> >> >> >> >> >> >> >> >is >> >> >> >> >> >> >> >> >iptables, libnet, and libpcap all that I might >> >> >> >> >> >> >> >> >need? >> >> >> >> >> >> >> >>>> >> >> >> >> >> >> >> AFAIK you don't need ebtables. You do need >> >> >> >> >> >> >> >> libipq>> >> >> >> >> >> >> >> for >> >> >> >> >> >> >> >> inline >> >> >> >> >> >> >> >> and >> >> >> >> >> >> >> >> libnet. >> >> >> >> >> >> >> >> This is how snort-inline attaches to iptables by >> >> >> >> >> >> >> >> using >> >> >> >> >> >> >> >> libipq >> >> >> >> >> >> >> >> instead >> >> >> >> >> >> >> >> of >> >> >> >> >> >> >> >> using libpcap. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >>>> >> >> >> >> >> >> >> > It is my impression that iptables just >> >> >> >> >> >> >> >> > firewalls>> >> >> >> >> >> >> >> > with >> >> >> >> >> >> >> >> > static >> >> >> >> >> >> >> >> > rules. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> On it's own, yes, but IPTables is VERY extensible >> >> >> >> >> >> >> >> via >> >> >> >> >> >> >> >> libipq.. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> That's where snort-inline comes in. Snort-inline >> >> >> >> >> >> >> >> interacts >> >> >> >> >> >> >> >> with >> >> >> >> >> >> >> >> iptables.>> >> >> >> >> >> >> >> It doesn't do things like create iptables rules >> >> >> >> >> >> >> >> to>> >> >> >> >> >> >> >> block >> >> >> >> >> >> >> >> packets, >> >> >> >> >> >> >> >> it >> >> >> >> >> >> >> >> the >> >> >> >> >> >> >> >> whole system becomes an iptables rule, it just >> >> >> >> >> >> >> >> happens >> >> >> >> >> >> >> >> to >> >> >> >> >> >> >> >> be a >> >> >> >> >> >> >> >> rule >> >> >> >> >> >> >> >> that >> >> >> >> >> >> >> >> runs snort instead of some simple expression. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> >> >> >> >> >Do the snort rules running on the transparent >> >> >> >> >> >> >> >> >inline >> >> >> >> >> >> >> >> >snort box >> >> >> >> >> >> >> >> >reset >> >> >> >> >> >> >> >> >the >> >> >> >> >> >> >> >> >traffic that passes through using inline? >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> Depends on if you use DROP or SDROP :).. However, >> >> >> >> >> >> >> >> inline >> >> >> >> >> >> >> >> doesn't >> >> >> >> >> >> >> >> JUST >> >> >> >> >> >> >> >> reset>> >> >> >> >> >> >> >> the traffic.. it also prevents the packet from >> >> >> >> >> >> >> >> being>> >> >> >> >> >> >> >> forwarded >> >> >> >> >> >> >> >> at >> >> >> >> >> >> >> >> all. >> >> >> >> >> >> >> >> DROP >> >> >> >> >> >> >> >> will also reset, SDROP won't. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> Snort 2.3's inline capacity is a direct port of >> >> >> >> >> >> >> >> snort-inline. >> >> >> >> >> >> >> >> You >> >> >> >> >> >> >> >> might >> >> >> >> >> >> >> >> want to check their FAQ for other info: >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> http://snort-inline.sourceforge.net/FAQ.html >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> ------------------------------------------------------- >> >> >> >> >> >> >> >> SF email is sponsored by - The IT Product Guide >> >> >> >> >> >> >> >> Read honest & candid reviews on hundreds of IT >> >> >> >> >> >> >> >> Products >> >> >> >> >> >> >> >> from >> >> >> >> >> >> >> >> real >> >> >> >> >> >> >> >> users.>> >> >> >> >> >> >> >> Discover which products truly live up to the >> >> >> >> >> >> >> >> hype.>> >> >> >> >> >> >> >> Start >> >> >> >> >> >> >> >> reading >> >> >> >> >> >> >> >> now. >> >> >> >> >> >> >> >> http://productguide.itmanagersjournal.com/ >> >> >> >> >> >> >> >> _______________________________________________ >> >> >> >> >> >> >> >> Snort-users mailing list >> >> >> >> >> >> >> >> Snort-users () lists sourceforge net >> >> >> >> >> >> >> >> Go to this URL to change user options or >> >> >> >> >> >> >> >> unsubscribe: >> >> >> >> >> >> >> >> https://lists.sourceforge.net/lists/listinfo/snort-users >> >> >> >> >> >> >> >> Snort-users list archive: >> >> >> >> >> >> >> >> http://www.geocrawler.com/redir-sf.php3?list=snort-users >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> >> >> >> > >> >> >> >> >> >> >> > ------------------------------------------------------- >> >> >> >> >> >> >> > SF email is sponsored by - The IT Product Guide >> >> >> >> >> >> >> > Read honest & candid reviews on hundreds of IT >> >> >> >> >> >> >> > Products >> >> >> >> >> >> >> > from real >> >> >> >> >> >> >> > users. >> >> >> >> >> >> >> > Discover which products truly live up to the hype. >> >> >> >> >> >> >> > Start >> >> >> >> >> >> >> > reading >> >> >> >> >> >> >> > now. >> >> >> >> >> >> >> > http://productguide.itmanagersjournal.com/ >> >> >> >> >> >> >> > _______________________________________________ >> >> >> >> >> >> >> > Snort-users mailing list >> >> >> >> >> >> >> > Snort-users () lists sourceforge net>> >> >> >> >> >> >> > Go to this URL to change user options or >> >> >> >> >> >> >> > unsubscribe:>> >> >> >> >> >> >> > https://lists.sourceforge.net/lists/listinfo/snort-users >> >> >> >> >> >> >> > Snort-users list archive: >> >> >> >> >> >> >> > http://www.geocrawler.com/redir-sf.php3?list=snort-users >> >> >> >> >> >> >> > >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> Best regards, >> >> >> >> >> >> Michael D. Peters >> >> >> Director of Security Services >> >> >> CISSP >> >> >> Lazarus Alliance Inc. >> >> >> M: 502-767-3448 >> >> >> O: 502-231-8017 x8 >> >> >> H: 502-231-6923 >> >> >> F: 502-231-5347 >> >> >> >> >> >> michael.peters () lazarusalliance com >> >> >> www.lazarusalliance.com >> >> >> >> >> >> Verify here: http://wwwkeys.us.pgp.net >> >> >> >> >> >> >> >> > >> >> > >> >> > ------------------------------------------------------- >> >> > SF email is sponsored by - The IT Product Guide >> >> > Read honest & candid reviews on hundreds of IT Products from real >> >> > users. >> >> > Discover which products truly live up to the hype. Start reading >> >> > now. >> >> > http://productguide.itmanagersjournal.com/ >> >> > _______________________________________________ >> >> > Snort-users mailing list >> >> > Snort-users () lists sourceforge net >> >> > Go to this URL to change user options or unsubscribe: >> >> > https://lists.sourceforge.net/lists/listinfo/snort-users >> >> > Snort-users list archive: >> >> > http://www.geocrawler.com/redir-sf.php3?list=snort-users >> >> > >> >> >> >> >> > >> >> >
------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Jan 02)
- <Possible follow-ups>
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Jan 02)
- RE: Re: Inline IP_Forwarding and other simple questions? Gould, Scott (Jan 02)
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Jan 04)