| Git Clone URL: | https://aur.archlinux.org/snort-nfqueue.git (read-only, click to copy) |
|---|---|
| Package Base: | snort-nfqueue |
| Description: | A lightweight network IDS / IPS with NFQUEUE and OpenAppID support. |
| Upstream URL: | https://www.snort.org |
| Keywords: | IDS intrusion IPS NFQUEUE OpenAppID |
| Licenses: | GPL |
| Conflicts: | snort |
| Provides: | snort |
| Submitter: | amish |
| Maintainer: | amish |
| Last Packager: | amish |
| Votes: | 1 |
| Popularity: | 0.000000 |
| First Submitted: | 2014-05-08 12:58 (UTC) |
| Last Updated: | 2024-04-12 01:30 (UTC) |
@graysky: Ok I tried again and I recall now what had happened the last time.
It worked randomly. Sometimes snort gave the following error and sometimes it worked. And that is why I switched to 'any'.
Dec 06 22:22:14 amish snort[47450]: ERROR: rules/snort.rules:4040 Undefined variable in the string: $EXTERNAL_NET.
I will implement the other change about -Q. Thanks for the TIP.
@amish - you can make the systemd service more flexible by dropping the hardcoded -Q and replacing it with a few lines in your local.lua see: https://github.com/graysky2/packages/blob/snort3/net/snort3/files/local.lua#L6-L7
And to answer your question, yes, it works, see: https://github.com/graysky2/packages/blob/snort3/net/snort3/files/homenet.lua
@graysky - Last when I had tried, it didnt work. Is it working for you now?
@amish - I see now (conversation from snort package). Shouldn't you define EXTERNAL_NET = "!$HOME_NET" in homenet.lua?
This snort version by default runs as INLINE (nfq) IDS as well as IPS. i.e. it works by using iptables / nft NFQUEUE target. i.e. it does not run in sniffing mode and it can block packets at firewall level.
However, you can perfectly run it as normal snort IDS by changing local.lua and systemd start up files.
Pinned Comments
amish commented on 2021-01-24 05:07 (UTC)
This snort version by default runs as INLINE (nfq) IDS as well as IPS. i.e. it works by using iptables / nft NFQUEUE target. i.e. it does not run in sniffing mode and it can block packets at firewall level.
However, you can perfectly run it as normal snort IDS by changing local.lua and systemd start up files.