<p dir="ltr">The public IP's (of both remote requester and the public IP of the web server) are shown in the http log. </p>
<p dir="ltr">Suricata is configured to listen on eth0 which is the interface facing public traffic.</p>
<div class="gmail_quote">On Oct 23, 2014 5:08 PM, "rmkml" <<a href="mailto:rmkml@yahoo.fr">rmkml@yahoo.fr</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Good!<br>
<br>
what's IPs appear on http-log please ? internal IPs ? external/nat IPs ?<br>
<br>
What network interface Suricata listen please ? internal ? external ?<br>
(maybe before NAT?)<br>
<br>
HOME_NET and EXTERNAL_NET need to understand where Suricata listen...<br>
<br>
Regards<br>
@Rmkml<br>
<br>
<br>
On Thu, 23 Oct 2014, Claudio Kuenzler wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Halleluja!<br>
<br>
After having changed HOME_NET and EXTERNAL_NET to any:<br>
<br>
HOME_NET: "any"<br>
<br>
EXTERNAL_NET: "any"<br>
<br>
... Suricata is now successfully detecting the scan as alert and is writing the alert into the unified2 file.<br>
<br>
Excellent advice rmkml, thanks.<br>
<br>
Just for the better understanding: If the machine Suricata is installed on a machine which serves as firewall/router, should HOME_NET and EXTERNAL_NET generally be set to "any"?<br>
<br>
On Thu, Oct 23, 2014 at 4:42 PM, rmkml <<a href="mailto:rmkml@yahoo.fr" target="_blank">rmkml@yahoo.fr</a>> wrote:<br>
Could you check:<br>
<a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux" target="_blank">https://redmine.<u></u>openinfosecfoundation.org/<u></u>projects/suricata/wiki/<u></u>Setting_up_IPSinline_for_Linux</a><br>
<br>
Well, if I understand correctly, Suricata log http request without nfqueue, if yes: you don't need nfqueue ;) (for suricata)<br>
or you need a "IPS" mode ?<br>
<br>
could you change $HOME_NET to any ? (because translation)<br>
Same with $EXTERNAL_NET to any please (for testing)<br>
<br>
like this:<br>
alert http any any -> any any (...<br>
<br>
Regards<br>
@Rmkml<br>
<br>
<br>
On Thu, 23 Oct 2014, Claudio Kuenzler wrote:<br>
<br>
<br>
<br>
Thx Claudio,<br>
<br>
<br>
Well thank you! :)<br>
<br>
<br>
ok, could you enable log on http/dns for testing please ? do you have log after ?<br>
<br>
<br>
Actually the logging of http works. Already before I disabled the checksum validation. I see typical requests to the web server.<br>
And I also see my nmap request in the http log - that's why I'm confused. Suricata sees the traffic from nmap going by, logging it in the http log but does not alert?<br>
<br>
<br>
where you start nmap please ? internal -> external ? external -> internal ?<br>
<br>
<br>
I launched nmap from my machine at home in internal network, being natted to an external IP and then straight to the server listening on a public IP, where suricata is installed. The http traffic is then natted from the public to an<br>
internal ip.<br>
So: internal -> NAT -> external -> NAT -> internal<br>
<br>
<br>
what is your nfqueue configuraton please ?<br>
<br>
<br>
That's exactly the point where I am not sure. Do I have to add an ipfilter rule for the NFQUEUE or not?<br>
Currently there is no NFQUEUE rule nor any special configuration I did on the machine (concerning NFQUEUE).<br>
<br>
<br>
are you sure nmap check http please ? (http is avalaible ? fw is open ?)<br>
<br>
<br>
The nmap command is "nmap -Pn -sS -A -f TARGETIP". Yes, it does check for http information, as I can see in the output:<br>
<br>
80/tcp open http nginx<br>
|_http-title: XXX<br>
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)<br>
443/tcp open http nginx<br>
|_http-methods: No Allow or Public header in OPTIONS response (status code 400)<br>
|_http-title: 400 The plain HTTP request was sent to HTTPS port<br>
| ssl-cert: Subject: commonName=*.<a href="http://smartlinksa.ch/organizationName=XXXX/stateOrProvinceName=XXXX/countryName=CH" target="_blank">smartlinksa.ch/<u></u>organizationName=XXXX/<u></u>stateOrProvinceName=XXXX/<u></u>countryName=CH</a><br>
<br>
<br>
<br>
could you record network packet like full tcpdump please ?<br>
<br>
<br>
Will do that if necessary (and send you private). But I still have some hope its due to the "non-configured" NFQUEUE situation. I have so far believed that this would not be necessary for suricata to run, but maybe it is? As stated<br>
above, that's the point<br>
where I am not sure.<br>
<br>
<br>
<br>
</blockquote>
</blockquote></div>