<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
Hi,</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
We’re using Suricata as inline IPS in our environment with iptable NFQUEUE rule setup. </div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
At this point we do not have any rule with “drop” action, all of them are “alert” only.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
But we have seen an issue where packet didn’t make it from server to remote client even without “drop” action, to be specific:</div>
<ul style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<li>We have a mysql server and we’re using curl as client from external host to send an request to mysql.</li><li>Without suricata, traffic went through just fine: connection established between client and server, and because client is NOT sending an actual query, server close the conn by sending FIN, and client FIN back.</li><li>With suricata enable and sit in the middle, connection established fine (client SYN, server SYN ACK, data packet exchanged etc.), but when server try to close the connection and sending the FIN, this particular packet is not make it way to client, causing
client side connection hangs.</li><li>Checked /proc/net/netfilter/nfnetlink_queue, both <span style="font-family: Arial, Helvetica, sans-serif; font-size: 13.920000076293945px; background-color: rgb(255, 255, 255);">dropped counter shows zero. However, as stated before, if bypass NFQUEUE and
suricata, FIN packet reach client without any issue.</span></li></ul>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<span style="color: rgb(0, 0, 0); font-family: Arial, Helvetica, sans-serif; font-size: 14px; font-style: normal; font-weight: normal; text-decoration: none;">Trying to figure out how possible this could go wrong, any help is much appreciated.</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<span style="color: rgb(0, 0, 0); font-family: Arial, Helvetica, sans-serif; font-size: 14px; font-style: normal; font-weight: normal; text-decoration: none;"><br>
</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<span style="color: rgb(0, 0, 0); font-family: Arial, Helvetica, sans-serif; font-size: 14px; font-style: normal; font-weight: normal; text-decoration: none;">Thanks,</span></div>
<div><font face="Arial,Helvetica,sans-serif">Zhao</font></div>
</body>
</html>