Re: Am I configuring snort correctly to run as an IPS

Thanks for the review.  So you're saying not to use two single quotes but to use two double quotes.

Bad: snort["-Q"] = ''
Good: snort["-Q"] = ""

Both seems to run and functional just fine.

The user documentation to which I referred is https://wiki.archlinux.org/title/Snort#General_Setup_and_Notes

------- Original Message -------
On Monday, December 12th, 2022 at 5:10 AM, Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]> wrote:


> Hello John,
> 
> It looks like your configuration and command line should work just fine.
> 
> The only problem I see is defining the snort["-Q"] option, it should look like this:
> 
> snort["-Q"] = ""
> 
> Can you please describe what problem you see?
> And it would also be nice if you left an indication of the paragraph in the user documentation that confused you.
> 
> Thanks,
> Vitalii!
> 
> From: Snort-users <[email protected]> on behalf of John via Snort-users <[email protected]>
> Date: Friday, 9 December 2022, 16:46
> To: [email protected] <[email protected]>
> Subject: [Snort-users] Am I configuring snort correctly to run as an IPS
> 
> I have snort running on my OpenWrt router/firewall which has two NICs:
> eth0 = LAN facing
> eth1 = WAN facing
> 
> My goal is to have snort running as an IPS dropping flagged packets.
> 
> I am running snort like this and the log file does show dropped matches:
>  snort -q -i eth0:eth1 -c /etc/snort/snort.lua --tweaks local
> 
> I am getting confused due to some user-written documentation stating that
> three not two NICs are required for this setup.
> 
> The only modifications I made to /etc/snort/snort.lua was the definitions of my
> HOME_NET and EXTERNAL_NET:
> HOME_NET = [[ 10.9.1.0/24 10.9.2.0/24 ]]
> EXTERNAL_NET = "!$HOME_NET"
> 
> Here is my /etc/snort/local.lua:
> output.logdir = '/mnt/mmcblk0p3'
> 
> snort = {}
> snort["-Q"] = ''
> 
> ips = {
>   mode = inline,
>   variables = default_variables,
>   include = RULE_PATH .. '/snort.rules',
> }
> 
> daq = {
>   module_dirs = {
>     '/usr/lib/daq',
>   },
>   modules = {
>     {
>       name = 'afpacket',
>       mode = 'inline',
>     },
>   },
> }
> 
> alert_fast = {
>   file = true,
>   packet = false,
> }
> 
> normalizer = {
>   tcp = {
>     ips = true,
>   }
> }
> 
> file_policy = {
>   enable_type = true,
>   enable_signature = true,
>   rules = {
>     use = {
>       verdict = 'log', enable_file_type = true, enable_file_signature = true
>     }
>   }
> }

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette