Re: Am I configuring snort correctly to run as an IPS

Hello John,

It looks like your configuration and command line should work just fine.
The only problem I see is defining the snort["-Q"] option, it should look like this:
snort["-Q"] = ""

Can you please describe what problem you see?
And it would also be nice if you left an indication of the paragraph in the user documentation that confused you.

Thanks,
Vitalii!

From: Snort-users <[email protected]> on behalf of John via Snort-users <[email protected]>
Date: Friday, 9 December 2022, 16:46
To: [email protected] <[email protected]>
Subject: [Snort-users] Am I configuring snort correctly to run as an IPS
I have snort running on my OpenWrt router/firewall which has two NICs:
eth0 = LAN facing
eth1 = WAN facing

My goal is to have snort running as an IPS dropping flagged packets.

I am running snort like this and the log file does show dropped matches:
 snort -q -i eth0:eth1 -c /etc/snort/snort.lua --tweaks local

I am getting confused due to some user-written documentation stating that
three not two NICs are required for this setup.

The only modifications I made to /etc/snort/snort.lua was the definitions of my
HOME_NET and EXTERNAL_NET:
HOME_NET = [[ 10.9.1.0/24 10.9.2.0/24 ]]
EXTERNAL_NET = "!$HOME_NET"

Here is my /etc/snort/local.lua:
output.logdir = '/mnt/mmcblk0p3'

snort = {}
snort["-Q"] = ''

ips = {
  mode = inline,
  variables = default_variables,
  include = RULE_PATH .. '/snort.rules',
}

daq = {
  module_dirs = {
    '/usr/lib/daq',
  },
  modules = {
    {
      name = 'afpacket',
      mode = 'inline',
    },
  },
}

alert_fast = {
  file = true,
  packet = false,
}

normalizer = {
  tcp = {
    ips = true,
  }
}

file_policy = {
  enable_type = true,
  enable_signature = true,
  rules = {
    use = {
      verdict = 'log', enable_file_type = true, enable_file_signature = true
    }
  }
}
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        [email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette