<div dir="ltr">Thanks, Eric. The use of mangle and PREROUTING is an attempt to only send traffic from the internal LAN interfaces to NFQUEUE for Suricata to inspect. I am hoping that will leave me with the ability to keep our current configuration of Snort listening on the WAN interface in IPS mode. It's definitely a learning experience for me.<div><br></div><div>I do remember reading about the save mark and restore mark. I will need to go back and add that.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, May 23, 2017 at 5:10 PM, Eric Leblond <span dir="ltr"><<a href="mailto:eric@regit.org" target="_blank">eric@regit.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Standord,<br>
<span class=""><br>
On Tue, 2017-05-23 at 17:01 -0500, Stanford Prescott wrote:<br>
> Thanks, David. I was coming from using Snort and running multiple<br>
> instances of Snort, one on each firewall interface, to listen to<br>
> traffic on each one. So, I was thinking I had to approach Suricata<br>
> the same way, but it is now apparent to me that Suricata in IPS mode<br>
> functions differently from Snort.<br>
><br>
> We are working on using Suricata in IPS nfq mode to listen on the<br>
> firewall's internal LAN interfaces. We already use Snort in a "type"<br>
> of IPS mode which involves moving offending IP addresses into an IP<br>
> block chain in iptables. However, it only works on the WAN interface.<br>
> We want to expand the abilities to be able to also listen on the<br>
> internal LAN interfaces, especially for outgoing traffic coming from<br>
> internal network devices. Our current setup for a type of snort IPS<br>
> on the WAN doesn't translate to the internal networks at all, so<br>
> Suricata appears to be a good solution to monitoring the internal<br>
> interfaces.<br>
><br>
> I have tried these iptables rules<br>
><br>
> iptables -t mangle -N jumpToSuricata<br>
> iptables -t mangle -A jumpToSuricata -m mark ! --mark 1/0x01 -j<br>
> NFQUEUE --queue-num 0<br>
<br>
</span>The basic concept of NFQ in repeat mode is to be able to use Suricata<br>
on the FORWARD chain (in combination with the existing iptables<br>
"firewall" ruleset) so it is rather strange to see you use NFQUEUE<br>
repeat mode in PREROUTING. Also sniffing in FORWARD will allow you to<br>
get all packets at a moment where NAT transformation do not hide you<br>
something of the reality of the traffic.<br>
<span class=""><br>
> # source inc.bits-flags to get definitions (assuming this is a shell<br>
> script)<br>
> . /etc/rc.d/inc.bits-flags<br>
><br>
> # Internal conns<br>
> iptables -t mangle -I PREROUTING 1 -m connmark --mark<br>
> $typeInternal/$connTypeMask -j jumpToSuricata <br>
> # Internal-to-smoothie conns<br>
> iptables -t mangle -I PREROUTING 1 -m connmark --mark<br>
> $typeInt2FW/$connTypeMask -j jumpToSuricata<br>
> # smoothie-to-internal conns<br>
> iptables -t mangle -I PREROUTING 1 -m connmark --mark<br>
> $typeFW2Int/$connTypeMask -j jumpToSuricata<br>
<br>
</span>Here you do not seem to restore the mark so I doubt this will work.<br>
<br>
BR,<br>
--<br>
Eric<br>
<div class="HOEnZb"><div class="h5"><br>
><br>
> and starting suricata with suricata -c /etc/suricata/suricata.yaml -q<br>
> 0 -vv -D<br>
> and suricata starts without any errors in the suricata.log file.<br>
><br>
> Now, I need to determine if it is doing what I am expecting it to do.<br>
><br>
> On Tue, May 23, 2017 at 1:00 AM, David Sussens <<a href="mailto:dsussens@gmail.com">dsussens@gmail.com</a>><br>
> wrote:<br>
> > Stan,<br>
> ><br>
> > You need to run suricata as follows:<br>
> ><br>
> > suricata -c /etc/suricata/suricata.yaml -q 0 -q 1 -q 2 -q3<br>
> ><br>
> > This is for a four queue setup. The multiple run modes error is<br>
> > related to the "-i" which tries to run Suricata in af-packet/pfring<br>
> > mode instead of nfq mode. <br>
> ><br>
> > The relevant interface is them determine by which chain the packets<br>
> > encounter as they enter the firewall. It is important to<br>
> > understand exactly how packets traverse the chains in order to make<br>
> > this work. <br>
> ><br>
> > If packets are being forwarded through the box, then the forward<br>
> > chain is used and the nfqueue rule needs to be there. <br>
> > If the packets are destined for a service listening locally on the<br>
> > box, then the input chain will be encounter. <br>
> > Ff the packets are originating from the box, then the output chain<br>
> > is used. <br>
> ><br>
> > In a situation where you have a local proxy running that accepts<br>
> > and then proxies traffic onward, then the input and output chains<br>
> > are relevant. <br>
> ><br>
> > This may all seem fairly self explanatory, but I have found that<br>
> > many issues are caused by a lack of understanding of how iptable<br>
> > chains interact with packets. <br>
> ><br>
> > David Sussens.<br>
> ><br>
> > On Tue, May 23, 2017 at 3:45 AM, Stanford Prescott <stan.prescott@g<br>
> > <a href="http://mail.com" rel="noreferrer" target="_blank">mail.com</a>> wrote:<br>
> > > When I add this rule <br>
> > > iptables -A INPUT -m mark ! --mark 1/1 -j NFQUEUE<br>
> > ><br>
> > > suricata.yaml with<br>
> > > nfq:<br>
> > > mode: repeat<br>
> > > repeat-mark: 1<br>
> > > repeat-mask: 1<br>
> > > # route-queue: 2<br>
> > > batchcount: 20<br>
> > > fail-open: no<br>
> > ><br>
> > > when I try to start Suricata<br>
> > > suricata -c /etc/suricata/suricata.yaml -i eth0 -vv -D -q 0<br>
> > ><br>
> > > I get an error stating that "more than one run mode has been<br>
> > > specified..."<br>
> > ><br>
> > > I can't see any other run modes I have set in suricata.yaml other<br>
> > > than "mode: repeat" but I am not sure what I am looking for.<br>
> > > <br>
> > ><br>
> > > On Mon, May 22, 2017 at 1:46 PM, Dominic Ruggiero <dominic1011@gm<br>
> > > <a href="http://ail.com" rel="noreferrer" target="_blank">ail.com</a>> wrote:<br>
> > > > Thanks to all who have been participating in the recent threads<br>
> > > > about<br>
> > > > Suricata Repeat Mode for your expertise!<br>
> > > ><br>
> > > > Suricata is now running on my hosts in Repeat Mode with no<br>
> > > > packet<br>
> > > > errors in suricata.log.<br>
> > > ><br>
> > > > - LXTerminal commands:<br>
> > > ><br>
> > > > sudo iptables -I INPUT -m mark ! --mark 1/1 -j NFQUEUE<br>
> > > > sudo iptables -I OUTPUT -m mark ! --mark 1/1 -j NFQUEUE<br>
> > > > sudo suricata -c /etc/suricata/suricata.yaml -q 0<br>
> > > ><br>
> > > > - Relevant suricata.log output (note the Errors 0!):<br>
> > > ><br>
> > > > (RX-Q0) Treated: Pkts 33144, Bytes 13638158, Errors 0<br>
> > > > (RX-Q0) Verdict: Accepted 33133, Dropped 10, Replaced 0<br>
> > > ><br>
> > > > - sudo iptables -vnL --line-numbers:<br>
> > > ><br>
> > > > Chain INPUT (policy DROP 0 packets, 0 bytes)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 2980 1405K NFQUEUE all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> mark match ! 0x1/0x1 NFQUEUE num 0<br>
> > > > 2 4344 1516K ufw-before-logging-input all -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 3 4344 1516K ufw-before-input all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 4 0 0 ufw-after-input all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 5 0 0 ufw-after-logging-input all -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 6 0 0 ufw-reject-input all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 7 0 0 ufw-track-input all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > ><br>
> > > > Chain FORWARD (policy DROP 0 packets, 0 bytes)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 ufw-before-logging-forward all -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 2 0 0 ufw-before-forward all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 3 0 0 ufw-after-forward all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 4 0 0 ufw-after-logging-forward all -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 5 0 0 ufw-reject-forward all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 6 0 0 ufw-track-forward all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > ><br>
> > > > Chain OUTPUT (policy ACCEPT 5 packets, 200 bytes)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 2895 806K NFQUEUE all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> mark match ! 0x1/0x1 NFQUEUE num 0<br>
> > > > 2 3909 887K ufw-before-logging-output all -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 3 3909 887K ufw-before-output all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 4 97 8448 ufw-after-output all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 5 97 8448 ufw-after-logging-output all -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 6 97 8448 ufw-reject-output all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 7 97 8448 ufw-track-output all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > ><br>
> > > > Chain ufw-after-forward (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-after-input (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 ufw-skip-to-policy-input udp -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> udp dpt:137<br>
> > > > 2 0 0 ufw-skip-to-policy-input udp -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> udp dpt:138<br>
> > > > 3 0 0 ufw-skip-to-policy-input tcp -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> tcp dpt:139<br>
> > > > 4 0 0 ufw-skip-to-policy-input tcp -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> tcp dpt:445<br>
> > > > 5 0 0 ufw-skip-to-policy-input udp -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> udp dpt:67<br>
> > > > 6 0 0 ufw-skip-to-policy-input udp -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> udp dpt:68<br>
> > > > 7 0 0 ufw-skip-to-policy-input all -- * *<br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ADDRTYPE match dst-<br>
> > > > type<br>
> > > > BROADCAST<br>
> > > ><br>
> > > > Chain ufw-after-logging-forward (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 LOG all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> limit: avg 3/min burst 10 LOG flags 0<br>
> > > > level 4<br>
> > > > prefix "[UFW BLOCK] "<br>
> > > ><br>
> > > > Chain ufw-after-logging-input (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 LOG all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> limit: avg 3/min burst 10 LOG flags 0<br>
> > > > level 4<br>
> > > > prefix "[UFW BLOCK] "<br>
> > > ><br>
> > > > Chain ufw-after-logging-output (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-after-output (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-before-forward (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 ACCEPT all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ctstate RELATED,ESTABLISHED<br>
> > > > 2 0 0 ACCEPT icmp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> icmptype 3<br>
> > > > 3 0 0 ACCEPT icmp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> icmptype 4<br>
> > > > 4 0 0 ACCEPT icmp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> icmptype 11<br>
> > > > 5 0 0 ACCEPT icmp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> icmptype 12<br>
> > > > 6 0 0 ACCEPT icmp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> icmptype 8<br>
> > > > 7 0 0 ufw-user-forward all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > ><br>
> > > > Chain ufw-before-input (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 1334 107K ACCEPT all -- lo * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 2 2973 1404K ACCEPT all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ctstate RELATED,ESTABLISHED<br>
> > > > 3 0 0 ufw-logging-deny all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ctstate INVALID<br>
> > > > 4 0 0 DROP all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ctstate INVALID<br>
> > > > 5 0 0 ACCEPT icmp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> icmptype 3<br>
> > > > 6 0 0 ACCEPT icmp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> icmptype 4<br>
> > > > 7 0 0 ACCEPT icmp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> icmptype 11<br>
> > > > 8 0 0 ACCEPT icmp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> icmptype 12<br>
> > > > 9 0 0 ACCEPT icmp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> icmptype 8<br>
> > > > 10 0 0 ACCEPT udp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> udp spt:67 dpt:68<br>
> > > > 11 37 4877 ufw-not-local all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 12 37 4877 ACCEPT udp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 224.0.0.251 udp dpt:5353<br>
> > > > 13 0 0 ACCEPT udp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 239.255.255.250 udp dpt:1900<br>
> > > > 14 0 0 ufw-user-input all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > ><br>
> > > > Chain ufw-before-logging-forward (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-before-logging-input (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-before-logging-output (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-before-output (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 1340 107K ACCEPT all -- * lo <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > 2 2472 771K ACCEPT all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ctstate RELATED,ESTABLISHED<br>
> > > > 3 97 8448 ufw-user-output all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > ><br>
> > > > Chain ufw-logging-allow (0 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 LOG all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> limit: avg 3/min burst 10 LOG flags 0<br>
> > > > level 4<br>
> > > > prefix "[UFW ALLOW] "<br>
> > > ><br>
> > > > Chain ufw-logging-deny (2 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 RETURN all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ctstate INVALID limit: avg 3/min burst<br>
> > > > 10<br>
> > > > 2 0 0 LOG all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> limit: avg 3/min burst 10 LOG flags 0<br>
> > > > level 4<br>
> > > > prefix "[UFW BLOCK] "<br>
> > > ><br>
> > > > Chain ufw-not-local (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 RETURN all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ADDRTYPE match dst-type LOCAL<br>
> > > > 2 37 4877 RETURN all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ADDRTYPE match dst-type MULTICAST<br>
> > > > 3 0 0 RETURN all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ADDRTYPE match dst-type BROADCAST<br>
> > > > 4 0 0 ufw-logging-deny all -- * * <br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> limit: avg 3/min burst 10<br>
> > > > 5 0 0 DROP all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > ><br>
> > > > Chain ufw-reject-forward (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-reject-input (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-reject-output (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-skip-to-policy-forward (0 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 DROP all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > ><br>
> > > > Chain ufw-skip-to-policy-input (7 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 DROP all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > ><br>
> > > > Chain ufw-skip-to-policy-output (0 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 ACCEPT all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > ><br>
> > > > Chain ufw-track-forward (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-track-input (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-track-output (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 42 2520 ACCEPT tcp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ctstate NEW<br>
> > > > 2 50 5728 ACCEPT udp -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> ctstate NEW<br>
> > > ><br>
> > > > Chain ufw-user-forward (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-user-input (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-user-limit (0 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 LOG all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> limit: avg 3/min burst 5 LOG flags 0<br>
> > > > level 4<br>
> > > > prefix "[UFW LIMIT BLOCK] "<br>
> > > > 2 0 0 REJECT all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> reject-with icmp-port-unreachable<br>
> > > ><br>
> > > > Chain ufw-user-limit-accept (0 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > > 1 0 0 ACCEPT all -- * * <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > > <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
> > > ><br>
> > > > Chain ufw-user-logging-forward (0 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-user-logging-input (0 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-user-logging-output (0 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > > Chain ufw-user-output (1 references)<br>
> > > > num pkts bytes target prot opt in out source<br>
> > > > destination<br>
> > > ><br>
> > > ><br>
> > > > Thanks Again,<br>
> > > ><br>
> > > > Dominic Ruggiero<br>
> > > ><br>
> > > ><br>
> > > ><br>
> > > > On Mon, May 22, 2017 at 10:03 AM, David Sussens <dsussens@gmail<br>
> > > > .com> wrote:<br>
> > > > > Stan, that mechanism is exactly what I have described. This<br>
> > > > feature has been<br>
> > > > > available for quite some time now.<br>
> > > > ><br>
> > > > > Good luck with your implementation.<br>
> > > > ><br>
> > > > > David Sussens.<br>
> > > > ><br>
> > > > > On 22 May 2017 17:14, "Stanford Prescott" <stan.prescott@gmai<br>
> > > > <a href="http://l.com" rel="noreferrer" target="_blank">l.com</a>> wrote:<br>
> > > > >><br>
> > > > >> Thank you, David. That should be very helpful. I think I got<br>
> > > > confused by<br>
> > > > >> the article I read which I am thinking is a new feature that<br>
> > > > has been added<br>
> > > > >> to suricata which appears to be a way of marking traffic<br>
> > > > with different<br>
> > > > >> marks to return to iptables to process depending on what the<br>
> > > > mark is.<br>
> > > > >> Perhaps like both traffic to be accepted and dropped are<br>
> > > > returned to<br>
> > > > >> iptables to be processed depending on what the mark is?<br>
> > > > >><br>
> > > > >> On Mon, May 22, 2017 at 4:26 AM, David Sussens <dsussens@gma<br>
> > > > <a href="http://il.com" rel="noreferrer" target="_blank">il.com</a>> wrote:<br>
> > > > >>><br>
> > > > >>> Basically what needs to be done is the following:<br>
> > > > >>><br>
> > > > >>> 1. In iptables:<br>
> > > > >>><br>
> > > > >>> -A INPUT -m mark ! --mark 1/1 -j NFQUEUE --queue-balance<br>
> > > > 0:3<br>
> > > > >>> --queue-bypass<br>
> > > > >>><br>
> > > > >>> You add the rule above. This rule works as follows:<br>
> > > > >>><br>
> > > > >>> Traffic that is does not have a mark/mask of 1/1 is<br>
> > > > forwarded to suricata<br>
> > > > >>> for processing. Once Suricata is finished processing, the<br>
> > > > traffic is<br>
> > > > >>> reinjected into the INPUT chain but this time the mark 1/1<br>
> > > > is set, which<br>
> > > > >>> means on the second round the trafffic is not forwarded to<br>
> > > > suricata and will<br>
> > > > >>> skip on to the rules lower down in the INPUT chain. <br>
> > > > Remember that traffic<br>
> > > > >>> is only reinjected if it was not dropped by Suricata. <br>
> > > > Thus, your marking<br>
> > > > >>> does not have to be specified in the suricata rules at all<br>
> > > > and it is<br>
> > > > >>> business as usual from that prespective.<br>
> > > > >>><br>
> > > > >>> 2. in suricata.yaml:<br>
> > > > >>><br>
> > > > >>> nfq:<br>
> > > > >>> mode: repeat<br>
> > > > >>> repeat-mark: 1<br>
> > > > >>> repeat-mask: 1<br>
> > > > >>> route-queue: 2<br>
> > > > >>> batchcount: 20<br>
> > > > >>> fail-open: no<br>
> > > > >>><br>
> > > > >>> You change the nfq mode from accept to repeat this causes<br>
> > > > packets that<br>
> > > > >>> were not rejected by Suricata to be reinjected into the<br>
> > > > appropriate chain.<br>
> > > > >>><br>
> > > > >>> This is how I am using it. In my case I am doing this to<br>
> > > > ensure that<br>
> > > > >>> traffic is first checked by Suricata, and then goes to the<br>
> > > > local Apache<br>
> > > > >>> Inverse Proxy.<br>
> > > > >>><br>
> > > > >>> Hope this helps.<br>
> > > > >>><br>
> > > > >>> David Sussens.<br>
> > > > >>><br>
> > > > >>><br>
> > > > >>><br>
> > > > >>><br>
> > > > >>> On Sun, May 21, 2017 at 10:04 PM, Stanford Prescott<br>
> > > > >>> <<a href="mailto:stan.prescott@gmail.com">stan.prescott@gmail.com</a>> wrote:<br>
> > > > >>>><br>
> > > > >>>> I ma trying to integrate Suricata 3.2.1 into our iptables<br>
> > > > firewall in<br>
> > > > >>>> IPS mode. We have have been using Snort in IDS mode but<br>
> > > > wanted to provide<br>
> > > > >>>> more filtering options. I like the possibility of using<br>
> > > > Suricata in IPS mode<br>
> > > > >>>> using nfq in repeat mode to return marked packets to the<br>
> > > > iptables table that<br>
> > > > >>>> sent the packets to Suricata for further processing. Snort<br>
> > > > doesn't seem to<br>
> > > > >>>> do this so we are trying to make the switch to Suricata.<br>
> > > > >>>><br>
> > > > >>>> I've been doing a lot of research to figure all of this<br>
> > > > out. I have read<br>
> > > > >>>> this excellent article about nfq and nfq_set_mark.<br>
> > > > >>>> <a href="https://home.regit.org/tag/suricata/page/4/" rel="noreferrer" target="_blank">https://home.regit.org/tag/<wbr>suricata/page/4/</a><br>
> > > > >>>><br>
> > > > >>>> To use iptables with mark and mask, the article indicates<br>
> > > > that the<br>
> > > > >>>> "nfq_set_mark" keyword needs to be added to the Suricata<br>
> > > > rules. How do I<br>
> > > > >>>> determine to what rules I add the keyword? Would I just<br>
> > > > add the keyword to<br>
> > > > >>>> every rule that Suricata is using as listed in<br>
> > > > suricata.yaml? Or is there a<br>
> > > > >>>> recommended set of rules to add the keyword? Or are there<br>
> > > > rule sets<br>
> > > > >>>> available that already have the keyword added to the<br>
> > > > rules?<br>
> > > > >>>><br>
> > > > >>>> Is Suricata able to set a mark for packets to be accepted<br>
> > > > and set a<br>
> > > > >>>> different mark for packets that need to be dropped or<br>
> > > > rejected?<br>
> > > > >>>><br>
> > > > >>>> Any other tips and suggestions for getting Suricata<br>
> > > > working in IPS mode<br>
> > > > >>>> working with iptables would be much appreciated.<br>
> > > > >>>><br>
> > > > >>>> ______________________________<wbr>_________________<br>
> > > > >>>> Suricata IDS Users mailing list: oisf-users@openinfosecfou<br>
> > > > <a href="http://ndation.org" rel="noreferrer" target="_blank">ndation.org</a><br>
> > > > >>>> Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support:<br>
> > > > >>>> <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/<wbr>support/</a><br>
> > > > >>>> List:<br>
> > > > >>>> <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/o" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/o</a><br>
> > > > isf-users<br>
> > > > >>>><br>
> > > > >>><br>
> > > > >><br>
> > > > >><br>
> > > > >> ______________________________<wbr>_________________<br>
> > > > >> Suricata IDS Users mailing list: oisf-users@openinfosecfound<br>
> > > > <a href="http://ation.org" rel="noreferrer" target="_blank">ation.org</a><br>
> > > > >> Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-" rel="noreferrer" target="_blank">http://suricata-</a><br>
> > > > <a href="http://ids.org/support/" rel="noreferrer" target="_blank">ids.org/support/</a><br>
> > > > >> List: <a href="https://lists.openinfosecfoundation.org/mailman/listin" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listin</a><br>
> > > > fo/oisf-users<br>
> > > > >><br>
> > > > ><br>
> > > > > ______________________________<wbr>_________________<br>
> > > > > Suricata IDS Users mailing list: oisf-users@openinfosecfounda<br>
> > > > <a href="http://tion.org" rel="noreferrer" target="_blank">tion.org</a><br>
> > > > > Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-" rel="noreferrer" target="_blank">http://suricata-</a><br>
> > > > <a href="http://ids.org/support/" rel="noreferrer" target="_blank">ids.org/support/</a><br>
> > > > > List: <a href="https://lists.openinfosecfoundation.org/mailman/listinf" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinf</a><br>
> > > > o/oisf-users<br>
> > > > ><br>
> > > ><br>
> > ><br>
> > ><br>
> > > ______________________________<wbr>_________________<br>
> > > Suricata IDS Users mailing list: oisf-users@<wbr>openinfosecfoundation<br>
> > > .org<br>
> > > Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-" rel="noreferrer" target="_blank">http://suricata-</a><br>
> > > <a href="http://ids.org/support/" rel="noreferrer" target="_blank">ids.org/support/</a><br>
> > > List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oi" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oi</a><br>
> > > sf-users<br>
> > ><br>
> ><br>
> ><br>
><br>
> ______________________________<wbr>_________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@<wbr>openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-" rel="noreferrer" target="_blank">http://suricata-</a><br>
> <a href="http://ids.org/support/" rel="noreferrer" target="_blank">ids.org/support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-u" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-u</a><br>
> sers<br>
</div></div><span class="HOEnZb"><font color="#888888">--<br>
Eric Leblond <<a href="mailto:eric@regit.org">eric@regit.org</a>><br>
</font></span></blockquote></div><br></div>