Re: snort3: How to disable rule processing ordering?

Are you sure you’re not looking for a firewall?

— 
Sent from my  iPhone

> On Dec 19, 2021, at 03:13, Özkan KIRIK via Snort-users <[email protected]> wrote:
> 
> Hi,
> 
> I'm trying to use snort3 for inline L4 filtering. (snort3-3.1.18.0)
> The user manual says:
> "string alerts.order = pass drop alert log: change the order of rule
> action application"
> Is it possible to disable rule action ordering completely?
> 
> For example;
> # need for first block, then alert
> block icmp any any -> 8.8.8.8 any (msg: "first block"; sid: 1; )
> alert icmp any any -> any any (msg: "allow + log icmp"; sid: 2; )
> # need for first alert then block
> alert tcp 192.168.1.0/24 any -> any any (msg: "allow+log tcp 24 bit
> subnet"; sid: 3; )
> block tcp 192.168.0.0./16 any -> any any (msg: "block tcp 16 bit
> subnet"; sid: 4; )
> # implicit rule
> block ip any any -> any any (msg: "last implicit rule", sid: 100 )
> 
> Snort, sorts the rules; so that it's not working as expected.
> Is there a way to make this ruleset work ?
> 
> Thanks, regards
> _______________________________________________
> Snort-users mailing list
> [email protected]
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
> 
>    To unsubscribe, send an email to:
>    [email protected]
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
> 
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette