Problems with snort 2.9 nfq inline

Hi,

I'm having problems with Snort 2.9.19 (2.9.12 and above) in inline mode.
The environment is CentOS 7 on AWS EC2 and the daq module is nfq.
I want to block attacks from one host (e.g. 10.0.3.51 as reverse proxy
server) to a specific network (10.0.10.0/24).
The iptables is configured as follows.


  # iptables -nL
  Chain INPUT (policy ACCEPT)
  target     prot opt source               destination
  NFQUEUE    all  --  10.0.10.0/24         0.0.0.0/0
NFQUEUE num 0 bypass

  Chain FORWARD (policy ACCEPT)
  target     prot opt source               destination

  Chain OUTPUT (policy ACCEPT)
  target     prot opt source               destination
  NFQUEUE    all  --  0.0.0.0/0            10.0.10.0/24
NFQUEUE num 0 bypass


Until Snort 2.9.11.2, the above configuration blocked attacks, but
since 2.9.12, it is no longer blocked.
Since 2.9.12, Snort outputs "Drop", but the packet passes through
after about 7 seconds.

The snort.conf is mostly default, with the following and rule paths changed.

  ipvar HOME_NET 10.0.10.0/24
  config policy_mode: inline

Snort is started with the following parameters.

  snort -A console -b -d -I -Q --daq nfq --daq-mode inline --daq-dir
/usr/local/lib/daq --daq-var queue_len=65535 --daq-var queue=0 -c
/etc/snort/snort.conf -l /var/log/snort/

I am wondering what is causing the packets to pass through after about
7 seconds.
Do I need to change any settings to block from 2.9.12 ?
Or is my network configuration and Snort placement incorrect to begin with?

I would appreciate any information.

Best regards,
Esaki
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette