Home / server / Questions / 590686
In Process
coanor
Asked: 2014-04-23 18:11:36 +0800 CST

iptables failed to forward packages to NFQ

  • 772

I have set the following rules in iptables:

sudo iptables -I INPUT -i eth0 -p tcp -s 192.168.37.184 -j NFQUEUE
sudo iptables -I OUTPUT -p tcp --dport 3306 -j NFQUEUE

What I want to do is forward all Mysql traffic data to NFQ, and I wish to detect these data in Suricata, but these iptable rules not working as expected, only part of the data in NFQ goes into Suricata(or only part of data goes into NFQ). but when I set the following iptables:

sudo iptables -I INPUT -j NFQUEUE
sudo iptables -I OUTPUT -j NFQUEUE

This works well, all the packages go into NFQ and all detected by Suricata, but this iptable rule forward all the traffic onto NFQ, and this is not I want.

My question is how to set specific iptables rules only apply to Mysql protocol?

iptables

1 Answers

  1. Check you have the NFQ kernel module loaded:

    lsmod | grep nfnetlink_queue

    Check to see if packets are matching those iptables rules

    sudo iptables -vn -L

    To just use the Suricata target for MySQL, the following should work:

    sudo iptables -I INPUT -p tcp --dport 3306 -j NFQUEUE
sudo iptables -I OUTPUT -p tcp --sport 3306 -j NFQUEUE
    • 0