<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
</head><body><p><span style="color: rgb(51, 51, 153);">Hello Albert</span></p><p><span style="color: rgb(51, 51, 153);">Suricata for IPS with NFQ works just fine, provided you configure the bridge correctly, iptables rules correctly and listen to the write queue with Suricata.</span></p><p><span style="color: rgb(51, 51, 153);">I know from personal experiencing that bridging is a real issue with kernels used in 16.04</span></p><p><span style="color: rgb(51, 51, 153);">Therefore my first question; Does your bridge work ok? ie are you passing traffic using the bridge alone? (leaving Suri (af packet etc) and iptables out completely)</span></p><p><span style="color: rgb(51, 51, 153);">if so:</span></p><p><span style="color: rgb(51, 51, 153);">Does you firewall work correctly, ie does an iptables rule to drop packets from one IP stop access via the bridge?</span></p><p><span style="color: rgb(51, 51, 153);">if yes:</span></p><p><span style="color: rgb(51, 51, 153);">Does Suri load ok...suricata in NFQ ACCEPT/DROP Mode</span></p><p><span style="color: rgb(51, 51, 153);">if yes:</span></p><p><span style="color: rgb(51, 51, 153);">Change the drop rule in iptables to NFQUEUE (default q is 0)</span></p><p><span style="color: rgb(51, 51, 153);">You should then be able to create a catch all type rule in Suricata and it will pick up your access.</span></p><p><span style="color: rgb(51, 51, 153);">The process generally is very simple.</span></p><p><span style="color: rgb(51, 51, 153);">Amar Rathore</span></p><p><span style="color: rgb(51, 51, 153);">SVP Product Development</span><br><span style="color: rgb(51, 51, 153);">CounterSnipe IDS/IPS Systems</span></p><blockquote type="cite">On March 11, 2018 at 1:18 PM <a href="mailto:Albert.Whale@IT-Security-inc.com">Albert.Whale@IT-Security-inc.com</a> wrote:<br><br><br>I am having serious doubts of NFQUEUE supporting the IPS design I have <br>been following. WHile I can get Suricata running and scanning <br>information, the only information that I can see in the fast.log are for <br>packets which as destined to this host (i.e. the LOCALHOST, or the IP <br>ADDRESS).<br><br>I had AF_PACKET mode scanning and detecting Multiple issues a minute. I <br>was thinking that this is ONLY IDS Mode. True or not?<br><br>I read the following in the Suricata.YAML which seems to indicate that <br>Suricata can be running af-packet and IPS inline?<br><br> # You can use the following variables to activate AF_PACKET tap or <br>IPS mode.<br> # If copy-mode is set to ips or tap, the traffic coming to the current<br> # interface will be copied to the copy-iface interface. If 'tap' is <br>set, the<br> # copy is complete. If 'ips' is set, the packet matching a 'drop' <br>action<br> # will not be copied.<br> copy-mode: ips<br><br><br>Suggestions?<br><br>_______________________________________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org" rel="noopener noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noopener noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noopener noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br><br>Conference: <a href="https://suricon.net" rel="noopener noreferrer" target="_blank">https://suricon.net</a><br>Trainings: <a href="https://suricata-ids.org/training/" rel="noopener noreferrer" target="_blank">https://suricata-ids.org/training/</a></blockquote></body></html>