Re: Snort 3 not dropping packets in IPS/inline mode

In your case, the eth0 and eth1 should be bridged, and don’t mix with management interface.

Here are some references:
http://sublimerobots.com/2016/02/snort-ips-inline-mode-on-ubuntu/

https://mahnura.github.io/final%20year%20project/2019/04/01/Setting-up-the-Network-Part-2.html


From: Mikha George <[email protected]>
Date: Friday, January 21, 2022 at 1:47 AM
To: Steven Baigal (sbaigal) <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [Snort-users] Snort 3 not dropping packets in IPS/inline mode
Okay. I will try that. Could you please brief on how the ideal inline daq afpacket setup should look like? Right now I have two network interfaces configured as inline pairs and both are assigned with an IP address, eth0 and eth1 respectively where eth1 also has a connection to the public internet.

On Fri, Jan 21, 2022 at 12:36 AM Steven Baigal (sbaigal) <[email protected]<mailto:[email protected]>> wrote:
I’ll suggest you verify your network setup first: stop the snort and ping between your endpoints, there should not be any traffic passing between your test endpoints.

From: Mikha George <[email protected]<mailto:[email protected]>>
Date: Thursday, January 20, 2022 at 12:17 PM
To: Steven Baigal (sbaigal) <[email protected]<mailto:[email protected]>>
Cc: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: Re: [Snort-users] Snort 3 not dropping packets in IPS/inline mode
Exactly my point, the rules are set correctly and shows the below in fast alert mode.

[cid:17e7b60c8cff7bcca9a4]

But in reality the verdict is showing pass and also snort3 is not dropping the packet. I did not have this problem while using snort2.9.
Here is my test rule:

drop icmp any any -> $HOME_NET any (msg:"ICMP connection test"; sid:1000001; rev:1;)
drop tcp any any -> $HOME_NET 80 (msg:"TCP connection test"; sid:1000002; rev:1;)

On Thu, Jan 20, 2022 at 10:32 PM Steven Baigal (sbaigal) <[email protected]<mailto:[email protected]>> wrote:
I only see pass verdict from this log. Are these packets expected to be dropped? Check your ips rules and make sure you have correct rules for your setup.

From: Mikha George <[email protected]<mailto:[email protected]>>
Date: Thursday, January 20, 2022 at 11:39 AM
To: Steven Baigal (sbaigal) <[email protected]<mailto:[email protected]>>
Cc: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: Re: [Snort-users] Snort 3 not dropping packets in IPS/inline mode
Hi Steven,

Thank you for the response.

Enabling the packet tracer showed the below result.

[cid:17e7b60c8cef2a753932]

On Thu, Jan 20, 2022 at 9:05 PM Steven Baigal (sbaigal) <[email protected]<mailto:[email protected]>> wrote:
You can enable packet tracer to debug the issue and see if the verdict was applied correctly:

packet_tracer = { enable = true, }

and you can also capture the pcap to see if tcp RST is generated correctly for both directions.
If you are using VLAN, please try the latest code, there was a bug fix related to drop connection for vlan traffic.


From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of Mikha George via Snort-users <[email protected]<mailto:[email protected]>>
Date: Wednesday, January 19, 2022 at 5:43 PM
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] Snort 3 not dropping packets in IPS/inline mode
Snort 3 is not dropping the packets even after the rule specifies to block packets. It is running in inline mode and shows drop but the packets are being sent however.

Snort is using the DAQ modules for running in inline mode. The command I use to run snort is as below:

./snort --daq-dir /usr/local/lib/daq --daq afpacket --daq-var debug --daq-var fanout_type=hash -i eth0:eth1 -Q -R /usr/local/snort/rules/local.rules -A alert_fast

I have two network interfaces attached as required which are up and running.

Any help is highly appreciated and would mean a lot. PFA screenshot for reference.



Thanks & Regards,

Mikha George
[cid:17e7b60c8cecb971f161]

[cid:17e7b60c8cff453195c3]

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette