Re: Am I configuring snort correctly to run as an IPS

Oh sorry, I got it wrong, I thought it was just a double quote. You are right, it will work correctly in both cases.
Regarding the documentation that you sent, in fact, everything is described correctly there. They describe the case when you want to build a custom "firewall" machine. In this case, you will need some kind of management port to log in to the machine and manage it, and two ports between which Snort will work.

Thanks,
Vitalii!

From: John <[email protected]>
Date: Monday, 12 December 2022, 13:11
To: Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [Snort-users] Am I configuring snort correctly to run as an IPS
Thanks for the review.  So you're saying not to use two single quotes but to use two double quotes.

Bad: snort["-Q"] = ''
Good: snort["-Q"] = ""

Both seems to run and functional just fine.

The user documentation to which I referred is https://wiki.archlinux.org/title/Snort#General_Setup_and_Notes

------- Original Message -------
On Monday, December 12th, 2022 at 5:10 AM, Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]> wrote:


> Hello John,
>
> It looks like your configuration and command line should work just fine.
>
> The only problem I see is defining the snort["-Q"] option, it should look like this:
>
> snort["-Q"] = ""
>
> Can you please describe what problem you see?
> And it would also be nice if you left an indication of the paragraph in the user documentation that confused you.
>
> Thanks,
> Vitalii!
>
> From: Snort-users <[email protected]> on behalf of John via Snort-users <[email protected]>
> Date: Friday, 9 December 2022, 16:46
> To: [email protected] <[email protected]>
> Subject: [Snort-users] Am I configuring snort correctly to run as an IPS
>
> I have snort running on my OpenWrt router/firewall which has two NICs:
> eth0 = LAN facing
> eth1 = WAN facing
>
> My goal is to have snort running as an IPS dropping flagged packets.
>
> I am running snort like this and the log file does show dropped matches:
>  snort -q -i eth0:eth1 -c /etc/snort/snort.lua --tweaks local
>
> I am getting confused due to some user-written documentation stating that
> three not two NICs are required for this setup.
>
> The only modifications I made to /etc/snort/snort.lua was the definitions of my
> HOME_NET and EXTERNAL_NET:
> HOME_NET = [[ 10.9.1.0/24 10.9.2.0/24 ]]
> EXTERNAL_NET = "!$HOME_NET"
>
> Here is my /etc/snort/local.lua:
> output.logdir = '/mnt/mmcblk0p3'
>
> snort = {}
> snort["-Q"] = ''
>
> ips = {
>   mode = inline,
>   variables = default_variables,
>   include = RULE_PATH .. '/snort.rules',
> }
>
> daq = {
>   module_dirs = {
>     '/usr/lib/daq',
>   },
>   modules = {
>     {
>       name = 'afpacket',
>       mode = 'inline',
>     },
>   },
> }
>
> alert_fast = {
>   file = true,
>   packet = false,
> }
>
> normalizer = {
>   tcp = {
>     ips = true,
>   }
> }
>
> file_policy = {
>   enable_type = true,
>   enable_signature = true,
>   rules = {
>     use = {
>       verdict = 'log', enable_file_type = true, enable_file_signature = true
>     }
>   }
> }

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette