<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body dir="auto"><div></div><div>I might have had a similar problem but with at-packet mode and sslvpn connection to a remote Sophos XG firewall. The symptom was not being able to have the Sophos admin GUI to appear. Was able to reach ssh and command line. Still exploring what is causing this problem.</div><div><br></div><div>Maybe not the same issue as you experienced but just weird.</div><div><br>On Apr 17, 2018, at 8:00 AM, David Sussens <<a href="mailto:dsussens@gmail.com">dsussens@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div><div>Albert,<br><br></div>I installed suricata 4.0.4 in NFQ mode. <br></div><div><br></div><div>My iptable configs:</div><div><br></div><div>Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)<br> pkts bytes target prot opt in out source destination <br> 4701 2019K NFQUEUE all -- enp0s3 enp0s2 <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> NFQUEUE balance 0:1 bypass<br> 6061 598K NFQUEUE all -- enp0s2 enp0s3 <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> NFQUEUE balance 0:1 bypass<br></div><div><br></div><div>Then I setup an apache2.4 web server with a self signed certificate on it. I am able to browse the website without problems. <br></div><div><br></div><div>This confirms, in my mind at least, that there is not an issue with 4.0.4 when it comes to SSL. <br></div><div><br></div><div>Regards,</div><div><br></div><div>David Sussens.<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 13, 2018 at 8:10 AM, David Sussens <span dir="ltr"><<a href="mailto:dsussens@gmail.com" target="_blank">dsussens@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div>Albert,<br><br></div>Can you please share your iptables/nftables rule base configs with us. That might help to determine what the problem is here.<br><br></div>David Sussens.<br></div> <br></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Tue, Apr 10, 2018 at 10:18 PM, Albert Whale <span dir="ltr"><<a href="mailto:Albert.Whale@it-security-inc.com" target="_blank">Albert.Whale@it-security-inc.<wbr>com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div bgcolor="#FFFFFF" text="#000000">
<p>Can someone please tell me why the connecting to HTTPS websites
are problematic when using the nfqueue run mode? This doesn't
happen when I am using af-packet mode.</p>
<p>In fact in nfqueue mode, I also get the following alerts from
fast.log:</p>
<p>04/10/2018-13:05:49.504292 [**] [1:2210007:2] ITS Safe STREAM
3way handshake SYNACK with wrong ack [**] [Classification: Generic
Protocol Command Decode] [Priority: 3] {TCP} <a href="http://17.249.105.246:443" target="_blank">17.249.105.246:443</a>
-> <a href="http://192.168.1.180:61378" target="_blank">192.168.1.180:61378</a><br>
04/10/2018-13:05:50.534691 [**] [1:2210007:2] ITS Safe STREAM
3way handshake SYNACK with wrong ack [**] [Classification: Generic
Protocol Command Decode] [Priority: 3] {TCP} <a href="http://17.249.105.246:443" target="_blank">17.249.105.246:443</a>
-> <a href="http://192.168.1.180:61378" target="_blank">192.168.1.180:61378</a><br>
04/10/2018-13:05:51.570889 [**] [1:2210007:2] ITS Safe STREAM
3way handshake SYNACK with wrong ack [**] [Classification: Generic
Protocol Command Decode] [Priority: 3] {TCP} <a href="http://17.249.105.246:443" target="_blank">17.249.105.246:443</a>
-> <a href="http://192.168.1.180:61378" target="_blank">192.168.1.180:61378</a><br>
04/10/2018-13:05:53.632130 [**] [1:2210007:2] ITS Safe STREAM
3way handshake SYNACK with wrong ack [**] [Classification: Generic
Protocol Command Decode] [Priority: 3] {TCP} <a href="http://17.249.105.246:443" target="_blank">17.249.105.246:443</a>
-> <a href="http://192.168.1.180:61378" target="_blank">192.168.1.180:61378</a></p>
<p><br>
</p>
<p>This is the error displayed in safari when I am running in-line
IPS mode:</p>
<p><img src="cid:part1.0A2A2152.055A361C@IT-Security-inc.com" alt=""></p>
<p>Any ideas or suggestions?<span class="m_-1127117738567297255HOEnZb"><font color="#888888"><br>
</font></span></p><span class="m_-1127117738567297255HOEnZb"><font color="#888888">
<div class="m_-1127117738567297255m_-2277878293308104038moz-signature">-- <br>
--<br>
<br>
Albert E. Whale, CEH CHS CISA CISSP<br>
Phone: 412-515-3010 | Email: <a class="m_-1127117738567297255m_-2277878293308104038moz-txt-link-abbreviated" href="mailto:Albert.Whale@IT-Security-inc.com" target="_blank">Albert.Whale@IT-Security-inc.c<wbr>om</a><br>
Cell: 412-889-6870<br>
<br>
</div>
</font></span></div>
<br></div></div>______________________________<wbr>_________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundati<wbr>on.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/suppor<wbr>t/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfound<wbr>ation.org/mailman/listinfo/<wbr>oisf-users</a><br>
<br>
Conference: <a href="https://suricon.net" rel="noreferrer" target="_blank">https://suricon.net</a><br>
Trainings: <a href="https://suricata-ids.org/training/" rel="noreferrer" target="_blank">https://suricata-ids.org/train<wbr>ing/</a><br></blockquote></div><br></div>
</blockquote></div><br></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br><span></span><br><span>Conference: <a href="https://suricon.net">https://suricon.net</a></span><br><span>Trainings: <a href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a></span></div></blockquote><BR />
<BR />
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to which they
are addressed. If you have received this email in error please notify Netsecuris management at mgmt@netsecuris.com. Please note that any views or opinions presented in
this email are solely those of the author and do not necessarily
represent those of Netsecuris Inc. The integrity and
security of this message cannot be guaranteed on the Internet
<BR />
</body></html>