Home / server / Questions / 177463
In Process
bradlis7
Asked: 2010-09-03 11:14:14 +0800 CST

Iptables QUEUE Target and Snort

  • 772

I'm trying to set up a firewall with support for snort, and it is dropping all of my packets when I add the QUEUE target. I've made it like this, but the QUEUE target is not allowing the packets to be processed any further:

-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -j QUEUE 
-A INPUT -j ACCEPT

# It's not allowing anything past QUEUE, as you can see below in the count.
> iptables -I INPUT -nv
 pkts bytes target     prot opt in     out     source               destination         
 6707  395K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
  933  138K QUEUE      all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

I'm eventually going to change it to forward, but I'm just trying to get it working for now. I start snort like so:

snort -Q -D -c /etc/snort/snort.conf

EDIT: More Information

When I run it, it still sees the packets without having an iptables QUEUE target rule, but when I add a QUEUE target, it starts losing all of my packets.

# snort -Qc /etc/snort/snort.conf -N -A console
Enabling inline operation
Running in IDS mode

        --== Initializing Snort ==--
Initializing Output Plugins!
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file "/etc/snort/snort.conf"
## === CUT ===
***
*** interface device lookup found: bond0
***
Initializing Network Interface bond0
Decoding Ethernet on interface bond0
## === CUT ===
Not Using PCAP_FRAMES

So, it says inline, but the it says it's using bond0. Inline should not require an interface, right?

iptables snort

1 Answers

  1. It seems ip_queue module is loaded here. Do the following and check once:

    modprobe ip_queue
modprobe iptable_filter

    And then add the queue rule. Check this once if it works.

    • 1