Re: snort3: How to disable rule processing ordering?

Right, I'm looking for an open source next generation firewall :)

Snort is a very powerful OpenAppID and IPS engine.
And also it has most of the features that the firewalls should have
such as stateful inspection, packet normalization and etc.

If we can disable rule ordering, it becomes an AppID enabled next
generation firewall.
Especially for the "inline" ips mode, it's required for doing both
AppID, IPS and packet filtering.

I know there may be a performance loss if rule ordering is disabled.
As a solution, maybe it's possible to do pattern matching concurrently
and then decide the pass / alert / drop according to the ruleset.
This feature is also useful especially for AppID rules such as:

alert tcp 192.168.1.5 any -> any any (msg: "pass+log facebook for
foo"; appid: "facebook"; sid: 1; )
block tcp any any -> any any (msg: "implicit block rule for facebook";
appid: "facebook"; sid: 2; )

Have a nice day / week

On Mon, Dec 20, 2021 at 4:02 AM Joel Esler <[email protected]> wrote:
>
> Are you sure you’re not looking for a firewall?
>
> —
> Sent from my  iPhone
>
> > On Dec 19, 2021, at 03:13, Özkan KIRIK via Snort-users <[email protected]> wrote:
> >
> > Hi,
> >
> > I'm trying to use snort3 for inline L4 filtering. (snort3-3.1.18.0)
> > The user manual says:
> > "string alerts.order = pass drop alert log: change the order of rule
> > action application"
> > Is it possible to disable rule action ordering completely?
> >
> > For example;
> > # need for first block, then alert
> > block icmp any any -> 8.8.8.8 any (msg: "first block"; sid: 1; )
> > alert icmp any any -> any any (msg: "allow + log icmp"; sid: 2; )
> > # need for first alert then block
> > alert tcp 192.168.1.0/24 any -> any any (msg: "allow+log tcp 24 bit
> > subnet"; sid: 3; )
> > block tcp 192.168.0.0./16 any -> any any (msg: "block tcp 16 bit
> > subnet"; sid: 4; )
> > # implicit rule
> > block ip any any -> any any (msg: "last implicit rule", sid: 100 )
> >
> > Snort, sorts the rules; so that it's not working as expected.
> > Is there a way to make this ruleset work ?
> >
> > Thanks, regards
> > _______________________________________________
> > Snort-users mailing list
> > [email protected]
> > Go to this URL to change user options or unsubscribe:
> > https://lists.snort.org/mailman/listinfo/snort-users
> >
> >    To unsubscribe, send an email to:
> >    [email protected]
> >
> > Please visit http://blog.snort.org to stay current on all the latest Snort news!
> >
> > Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette