Snort mailing list archives
Re: Iptables and snort inline
From: Victor Julien <victor () nk nl>
Date: Thu, 09 Jun 2005 11:14:31 +0200
lmarcilly () aressi fr wrote:
Hi all! I try to use iptables and snort inline on a bridging firewall. This is my configuration for testing : ------ ---------- | PC |---------| Bridge |--------- LAN ------ ---------- 192.168.1.99 192.168.1.185 192.168.1.0/24 When snort inline does not run, I can't reach the LAN. I think it's normal but it's not what i want. In fact, i would like that when snort inline doesn't run, iptables don't put packet in the queue. Like this, even if traffic isn't analysed by snort, i always can reach the LAN... I can't find info in the snort user mailling list archive because source-forge is down for the moment so i hope you have a solution to my problem... Is there a patch to apply to iptables in order to react when snort is down? Or is this only a problem in the rules?
I believe that when you use QUEUE rules, the packets will be dropped if either: 1. no snort_inline is running. 2. snort_inline hangs for some reason. The packets cannot continue travesing the rules because when the QUEUE target is used, the packets basicly leave the netfilter framework, only to be reinserted when the verdict is set. For the verdict to be set, the QUEUE-listener must be running :-) If snort_inline is not running because it crashed, you could try the following: 1. send a bugreport to snort-inline-users 2. write a script that checks if snort-inline runs, and if it doesn't, starts it again. 3. as 2, but instead of starting snort-inline again, change the iptables rules so ACCEPT is used instead of QUEUE. Hope this helps! Regards, Victor ------------------------------------------------------- This SF.Net email is sponsored by: NEC IT Guy Games. How far can you shotput a projector? How fast can you ride your desk chair down the office luge track? If you want to score the big prize, get to know the little guy. Play to win an NEC 61" plasma display: http://www.necitguy.com/?r=20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Iptables and snort inline lmarcilly (Jun 09)
- Re: Iptables and snort inline Victor Julien (Jun 09)