<html><head></head><body>The other way to do this is with af-packet mode. You don't need iptables then. The action on signature determines whether it is performing IDS or IPS mode.<br><br><font size="2" face="Arial">Leonard </font><br><br><br><div><strong>
From:
</strong>
Blason R <blason16@gmail.com>
<br>
<strong>
To:
</strong>
Amar Rathore - CounterSnipe Systems <amar@countersnipe.com>
<br>
<strong>
Cc:
</strong>
<oisf-users@lists.openinfosecfoundation.org>
<br>
<strong>
Sent:
</strong>
12/28/2017 9:06 AM
<br>
<strong>
Subject:
</strong>
Re: [Oisf-users] Suricata IPS with named - Please suggest use case
<br><br><blockquote class="mori" style="margin:0 0 0 .8ex;border-left:1px solid #CCC;padding-left:1ex;"><div>Thanks for idea need to work out on this. Any reference document would really appreciate.<br></div><div class="mcntgmail_extra"><br><div class="mcntgmail_quote">On Wed, Dec 27, 2017 at 8:07 PM, Amar Rathore - CounterSnipe Systems <span><<a href="mailto:amar@countersnipe.com" target="_blank" title="Send email to amar@countersnipe.com" class="mailto">amar@countersnipe.com</a>></span> wrote:<br><blockquote class="mcntgmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><u></u>
<div><p style="color: rgb(0, 0, 128); font-family: arial, helvetica, sans-serif; font-size: 12pt;">You can certainly do that.<br></p><p style="color: rgb(0, 0, 128); font-family: arial, helvetica, sans-serif; font-size: 12pt;">Setup Suricata to do IPS not IDS, with NFQ and use iptables to push all/selective eth0/INPUT traffic to Suricata.<br></p><p style="color: rgb(0, 0, 128); font-family: arial, helvetica, sans-serif; font-size: 12pt;">You can then use any rules and set action to drop on them as required.<br></p><p style="color: rgb(0, 0, 128); font-family: arial, helvetica, sans-serif; font-size: 12pt;">Amar<br></p><p style="color: rgb(0, 0, 128); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><br></p><blockquote type="cite"><div><div class="mcnth5">On December 23, 2017 at 2:49 PM Blason R <<a href="mailto:blason16@gmail.com" target="_blank" title="Send email to blason16@gmail.com" class="mailto">blason16@gmail.com</a>> wrote:<br><br><div>Hi Guys,<div><br></div><div>Can someone please help me with this idea? I have DNS server set up on CentOS 7.4 which is acting as a sinkhole server where I have installed ELK stack as well. </div><div><br></div><div>Since this named/bind is acting as a sinkhole it is already blocking malicious known domains collected from OSINT.</div><div><br></div><div>My idea here is; if it is possible to integrate/install suricata IPS on same server and monitor on eth0? And since that is a DNS server can I block the response IP addresses received which may be malicious.</div><div><br></div><div>for example</div><div><br></div><div><a href="http://www.looks-genuine.com" target="_blank">www.looks-genuine.com</a> = Domain may not be listed in blacklist</div><div>15.16.1.18 ==> But IP is malicious hence either block it or alert it</div><div><br></div><div>Plus detect the advance level of DNS attacks? like iodine, DNS beacon channels queries? </div><div><br></div><div>Please suggest; can this be achieved? </div></div></div></div>_______________________________________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank" title="Send email to oisf-users@openinfosecfoundation.org" class="mailto">oisf-users@openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br><br>Conference: <a href="https://suricon.net" target="_blank">https://suricon.net</a><br>Trainings: <a href="https://suricata-ids.org/training/" target="_blank">https://suricata-ids.org/training/</a></blockquote></div>
</blockquote></div><br></div>
<br><br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br><br>Conference: https://suricon.net<br>Trainings: https://suricata-ids.org/training/</blockquote></div></body></html>