I run a Centos 6.5 server with a highly restrictive iptables ruleset allowing incoming traffic only on a small handful of tcp ports (8 in total) and blocks all incoming unsolicited UDP traffic.
I recently built snort 2.9.7.0 from source and am running it in policy_mode:inline-test
I notice it's alerting on packets that are blocked by my iptables configuration, from which I surmise it's inserted itself in the processing chain before iptables.
I have read the manual and done several web searches but can find no mention of this behavior, or how to configure it so it runs after iptables. I don't believe I need alerts on traffic that will be blocked anyway.
Is there a reason I would want to see those alerts, and if not, is there a way to set things up so I don't get alerts for iptables-blocked packets?
Since both Snort and Iptables getting the packets from interface so both will process the packets and both will trigger the action which is given by you in the rule. There is no need to use Iptables if you are running Snort. Create a rule for Snort which you have configured Iptables and set the rule action Drop in Snort rule. It will do the same work as iptables. Since you are analyzing the traffic inline so you have compile the snort with nfq(netfilter queue). In inline mode snort will take the packets from the queue.