Hi, what's the output of iptables -nvL ? Is the FORWARD rule incrementing any data? <span></span><br><br>On Sunday, October 23, 2016, mostafa ammar <<a href="mailto:mostafaammar79@gmail.com">mostafaammar79@gmail.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Dear Chris,<br><br></div>thanks a lot for your reply,yes correctly I want to make a single broadcast domain through IPS machine, so that all traffic is forced to pass through IPS machine to reach its destination .<br><br> I tried all your configuration , unfortunately it did not work.<br><br></div>currently when capturing on IPS machine I see traffic is not moving from one interface to the other however all configuration are as stated any trials suggested.<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Oct 23, 2016 at 3:39 AM, Chris Boley <span dir="ltr"><<a href="javascript:_e(%7B%7D,'cvml','ilgtech75@gmail.com');" target="_blank">ilgtech75@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>I set up an IPS VM inline some time ago, but it was a little different than what you're attempting.<br><br></div>You're trying to create a broadcast domain between vlan 9 and vlan 10 which would otherwise be logically separated. <br><br>I'll suggest this:<br><br>iptables rules on your IPS VM:<br><br>iptables -A FORWARD -j NFQUEUE<br><br>iptables -I INPUT -i lo -j ACCEPT<br>iptables -I INPUT -i eth0 -j ACCEPT<br>iptables -A INPUT -j NFQUEUE<br><br><br></div>SYSCTL...on your IPS VM<br><div><br>root@suricata:/home/ipsadmin# sysctl -a | grep net.bridge<br><br>>>>> net.bridge.bridge-nf-filter-vl<wbr>an-tagged = 1 <br><br> << your vswitch might be doing something really strange with traffic going back and forth to your virtual interfaces. Your traffic might be have problems being properly read as it's crossing through the xenserver vswitch. I can't speak for how the vswitch handles that. The net.bridge.bridge-nf-filter-vl<wbr>an-tagged = 1 setting allows the bridge to strip vlan tags and send to iptables without the vlan tag. Then the traffic can be read by netfilter(NFQUEUE) and pushed into suricata for inspection. If you are for example scanning over a dot1q link, like a "trunk" between cisco switches, the IPS won't work unless you're making that sysctl change. It just can't see the vlan tagged traffic.<br><br></div><div>Make sure to go ahead and try moving that setting to a "1" by default it is a "0" it won't bother any of the other functionality of your VM anyway.<br></div><div><br>A very simple test interfaces file inside your IPS VM:<br><br>auto lo<br>iface lo inet loopback<br><br>auto eth0<br>iface eth0 inet static<br> address x.x.x.x<br> netmask x.x.x.x<br> gateway x.x.x.x<span><br><br>auto eth2<br>iface eth2 inet manual<br></span> post-up ifconfig $IFACE up<br> pre-down ifconfig $IFACE down<span><br><br>auto eth3<br>iface eth3 inet manual<br></span> post-up ifconfig $IFACE up<br> pre-down ifconfig $IFACE down<br><br><br>auto br0<br>iface br0 inet static<br> address 0.0.0.0<br> netmask 255.255.255.255<br> bridge_ports eth1 eth2<br> bridge_stp off<br> post-down brctl delbr br0<br><br></div><div>Then <br></div><div>A simple test suricata startup without all the interface copy stuff you had in there before.<br></div><div><span>sudo suricata -q 0 -c /etc/suricata/suricata.yaml <br><br></span></div><div><span>I might be wrong but I think this will get you really close to allowing those two devices to pass traffic over the virtual linux bridge on that VM.<br><br></span></div><div><span>I realize it's not the interface copy method. Apologies, I only desire to offer what I actually do understand to help you with a solution.<br></span></div><div><span><br></span></div><div><span><br></span></div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div>On Sat, Oct 22, 2016 at 9:46 AM, mostafa ammar <span dir="ltr"><<a href="javascript:_e(%7B%7D,'cvml','mostafaammar79@gmail.com');" target="_blank">mostafaammar79@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr">Dear All,<div><div><br></div><div>I adjuste sirucata.yaml with the below configuration for eth2 and eth3 and using the command</div><div>sudo suricata -c ~/sirucata-3.`/sirucata.yaml --af--packet , ping is working but all other protocols are dropped , any one have anidea what can be such issue?</div><div>I am having the same issue with snort being inline for traffic , only ping is passing and all other types of traffic is dropped.</div><div><br></div><div> - interface: eth2</div><div> threads: 32</div><div> defrag: yes</div><div> cluster-type: cluster_flow</div><div> cluster-id: 98</div><div> copy-mode: ips</div><div> copy-iface: eth3</div><div> buffer-size: 64535</div><div> use-mmap: yes</div><div> - interface: eth3</div><div> threads: 32</div><div> cluster-id: 97</div><div> defrag: yes</div><div> cluster-type: cluster_flow</div><div> copy-mode: ips</div><div> copy-iface: eth2</div><div> buffer-size: 64535</div><div> use-mmap: yes</div></div><div><br></div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Oct 22, 2016 at 11:15 AM, mostafa ammar <span dir="ltr"><<a href="javascript:_e(%7B%7D,'cvml','mostafaammar79@gmail.com');" target="_blank">mostafaammar79@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div><div>Dear All,<br><br></div>i installed suricata as a vm on xenserver hypervisor to work as inline ips between VM , I added 3 interfaces to VM ,one management and 2 interfaces sensing , one in vlan 9 and another in vlan 10 (interface eth2,eth3)<br><br></div>i installed suricata with NFqueue support and when running with<br> sudo suricata -c /home/ubuntu/suricata-3.1/suri<wbr>cata.yaml -q 0<br></div>it runs successfully<br></div>I added the following to /etc/network/interface<br><br>auto eth2<br>iface eth2 inet manual<br> up ifconfig eth2 0.0.0.0 up<br> up ip link set eth2 promisc on<br> post-up ethtool -K eth2 gro off<br> post-up ethtool -K eth2 lro off<br> down ip link set eth2 promisc off<br> down ifconfig eth2 down<br> <br># Second Bridged Interface<br>auto eth3<br>iface eth3 inet manual<br> up ifconfig eth3 0.0.0.0 up<br> up ip link set eth3 promisc on<br> post-up ethtool -K eth3 gro off<br> post-up ethtool -K eth3 lro off<br> down ip link set eth3 promisc off<br> down ifconfig eth3 down<br><br></div>and this is a snapshot of iptables<br>ubuntu@ubuntu-HVM-domU:~$ sudo iptables -vnL<br>Chain INPUT (policy ACCEPT 16525 packets, 15M bytes)<br> pkts bytes target prot opt in out source destination <br> 0 0 ACCEPT all -- eth2 * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <br> 0 0 ACCEPT all -- eth3 * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <br> 0 0 ACCEPT all -- eth2 * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <br><br>Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)<br> pkts bytes target prot opt in out source destination <br> 0 0 NFQUEUE all -- eth3 eth2 <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> NFQUEUE num 0<br> 0 0 NFQUEUE all -- eth2 eth3 <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> NFQUEUE num 0<br><br><br></div>now i added 2 VMs one in vlan 9 and another in vlan 10 but ping is not working and i see no packets at eth3 with wireshark <br><br></div>any help about that<br></div>
</blockquote></div><br></div>
</div></div><br></div></div>______________________________<wbr>_________________<br>
Suricata IDS Users mailing list: <a href="javascript:_e(%7B%7D,'cvml','oisf-users@openinfosecfoundation.org');" target="_blank">oisf-users@openinfosecfoundati<wbr>on.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/suppor<wbr>t/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfound<wbr>ation.org/mailman/listinfo/ois<wbr>f-users</a><br>
Suricata User Conference November 9-11 in Washington, DC: <a href="http://suricon.net" rel="noreferrer" target="_blank">http://suricon.net</a><br></blockquote></div><br></div>
</blockquote></div><br></div>
</blockquote>