Re: Inline IP_Forwarding and other simple questions?

[Will Metcalf <william.metcalf () gmail com>]

> What I am asking is since this uses IPTABLES, should I just set up permanent
> "firewall type" IPTABLE rules and then use the modified snort rules to take
> care of the resets, drops, etc?

Yes


On Tue, 28 Dec 2004 18:02:12 -0500, Michael D. Peters
<mdpeters () lazarusalliance com> wrote:
> What I am asking is since this uses IPTABLES, should I just set up permanent
> "firewall type" IPTABLE rules and then use the modified snort rules to take
> care of the resets, drops, etc?
>
>
> Will Metcalf writes:
>
> > > If I have something like this:     <GATEWAY-ROUTER> connected to <FIREWALL>
> > > connected to <SNORT_INLINE> connected to <NETWORK HUB OR SWITCH>. Would I
> > > set the "var HOME_NET any" to "var HOME_NET nnn.nnn.nnn.nnn/xx?
> >
> > Yes
> >
> > > Do I need to make a startup script for IPTABLE rules or do I rely on
> > > drop.rules or both? I'm inclined to think that the firewall rules will be
> > > essentially duplicated with IPTABLES and the drop.rules interactively
> > > supplement the IPTABLES.
> >
> > I'm not really sure what you are asking for here......  Usually it is
> > a good idea to have a couple of iptables rules to check state for tcp
> > state etc.  Just off the top of my head.....
> >
> > iptables -P FORWARD DROP
> > iptables -A FORWARD -p tcp --syn -m state --state NEW -j QUEUE
> > iptables -A FORWARD -p tcp -m state --state RELATED,ESTABLISHED -j QUEUE
> > iptables -A FORWARD -p udp -j QUEUE
> > iptables -A FORWARD -p icmp -j QUEUE
> >
> > > Would MySQL logging be done the same way for Snort-inline as it is with
> > > regular Snort?
> > >
> > > output database: alert, mysql, dbname=snort user=snortuser host=localhost
> > > password=snortuserpassword
> >
> > Yes
> >
> > Regards,
> >
> > Will
> >
> >
> >
> >
> > On Tue, 28 Dec 2004 10:58:28 -0500, mdpeters
> > <michael.peters () lazarusalliance com> wrote:
> > > Concerning the snort-inline.conf file, are the "var" statements relevant?
> > > Should I specify the network and subnet that the snort-inline box runs on?
> > >
> > > If I have something like this:     <GATEWAY-ROUTER> connected to <FIREWALL>
> > > connected to <SNORT_INLINE> connected to <NETWORK HUB OR SWITCH>. Would I
> > > set the "var HOME_NET any" to "var HOME_NET nnn.nnn.nnn.nnn/xx?
> > >
> > > Do I need to make a startup script for IPTABLE rules or do I rely on
> > > drop.rules or both? I'm inclined to think that the firewall rules will be
> > > essentially duplicated with IPTABLES and the drop.rules interactively
> > > supplement the IPTABLES.
> > >
> > > Thank you for the continued education and assistance.   :)
> > >
> > > ----- Original Message -----
> > > From: "Will Metcalf" <william.metcalf () gmail com>
> > > To: "mdpeters" <michael.peters () lazarusalliance com>
> > > Sent: Monday, December 27, 2004 12:04 PM
> > > Subject: Re: [Snort-users] Inline IP_Forwarding and other simple questions?
> > >
> > > > because, you are not pulling traffic off of the bridge.  You are
> > > > pulling traffic out of iptables, via the QUEUE target.  As far as the
> > > > rules go, you need to convert alert to drop/sdrop/reject.
> > > >
> > > > Regards,
> > > >
> > > > Will
> > > >
> > > >
> > > > On Mon, 27 Dec 2004 11:36:10 -0500, mdpeters
> > > > <michael.peters () lazarusalliance com> wrote:
> > > > > One instance for both interfaces or just one like you wrote? How does it
> > > > > know what interface the bridge is on?
> > > > >
> > > > >
> > > > > ----- Original Message -----
> > > > > From: "Will Metcalf" <william.metcalf () gmail com>
> > > > > To: "mdpeters" <michael.peters () lazarusalliance com>
> > > > > Sent: Monday, December 27, 2004 11:00 AM
> > > > > Subject: Re: [Snort-users] Inline IP_Forwarding and other simple
> > > > > questions?
> > > > >
> > > > > > look at inline readme file under doc in your source.
> > > > > >
> > > > > > you were close....
> > > > > >
> > > > > > /opt/snort/bin/snort-inline -Q -l /var/log/snort/ -D -c
> > > > > > /opt/snort/etc/snort_inline.conf
> > > > > >
> > > > > > something like that...
> > > > > >
> > > > > > Regards,
> > > > > >
> > > > > > Will
> > > > > >
> > > > > >
> > > > > > On Mon, 27 Dec 2004 09:46:33 -0500, mdpeters
> > > > > > <michael.peters () lazarusalliance com> wrote:
> > > > > > > Right now I have this running:
> > > > > > >
> > > > > > > /opt/snort/bin/snort-inline -Q -c /opt/snort/etc/inline1.conf -i
> > > > > > > eth1 -l
> > > > > > > /var/log/snort-inline1 -D
> > > > > > > /opt/snort/bin/snort-inline -Q -c /opt/snort/etc/inline2.conf -i
> > > > > > > eth2 -l
> > > > > > > /var/log/snort-inline2 -D
> > > > > > >
> > > > > > > I apparently do not understand how inline works.
> > > > > > >
> > > > > > > What would the snort-inline command be to work on a transparent bridge
> > > > > > > snort-inline with iptables?
> > > > > > >
> > > > > > > Where can I read up?
> > > > > > >
> > > > > > > I appreciate your help!
> > > > > > >
> > > > > > > ----- Original Message -----
> > > > > > > From: "Will Metcalf" <william.metcalf () gmail com>
> > > > > > > To: "mdpeters" <michael.peters () lazarusalliance com>
> > > > > > > Sent: Monday, December 27, 2004 8:14 AM
> > > > > > > Subject: Re: [Snort-users] Inline IP_Forwarding and other simple
> > > > > > > questions?
> > > > > > >
> > > > > > > > neither you would use the -Q switch to tell snort to read from
> > > > > > > > ip_queue.  Then you have to send traffic to snort with iptables with
> > > > > > > > a
> > > > > > > > rule like this.
> > > > > > > >
> > > > > > > > iptables -A FORWARD -j QUEUE
> > > > > > > >
> > > > > > > >
> > > > > > > > On Mon, 27 Dec 2004 00:06:30 -0500, mdpeters
> > > > > > > > <michael.peters () lazarusalliance com> wrote:
> > > > > > > > > Would I need to use the bridge "br0" group interface or the
> > > > > > > > > individual
> > > > > > > > > interfaces "eth0' and "eth1" that make up the group for the
> > > > > > > > > Snort-inline
> > > > > > > > > start command?
> > > > > > > > >
> > > > > > > > > Thanks,
> > > > > > > > > Michael
> > > > > > > > >
> > > > > > > > > ----- Original Message -----
> > > > > > > > > From: "Will Metcalf" <william.metcalf () gmail com>
> > > > > > > > > To: "Matt Kettler" <mkettler () evi-inc com>
> > > > > > > > > Cc: "mdpeters" <michael.peters () lazarusalliance com>;
> > > > > > > > > <snort-users () lists sourceforge net>
> > > > > > > > > Sent: Thursday, December 23, 2004 4:43 PM
> > > > > > > > > Subject: Re: [Snort-users] Inline IP_Forwarding and other simple
> > > > > > > > > questions?
> > > > > > > > >
> > > > > > > > > > Well said, except that drop does not reset the connection.  Using
> > > > > > > > > > reject will drop and reset the connection.
> > > > > > > > > >
> > > > > > > > > > Regards,
> > > > > > > > > >
> > > > > > > > > > Will
> > > > > > > > > >
> > > > > > > > > > On Thu, 23 Dec 2004 15:21:37 -0500, Matt Kettler
> > > > > > > > > > <mkettler () evi-inc com>
> > > > > > > > > > wrote:
> > > > > > > > > > > At 02:04 PM 12/23/2004, mdpeters wrote:
> > > > > > > > > > > > Do I need to enable ip_forwarding on for the transparent bridge
> > > > > > > > > > > > to
> > > > > > > > > > > > work?
> > > > > > > > > > >
> > > > > > > > > > > As I understand it, you explicitly MUST NOT enable
> > > > > > > > > > > ip_forwarding,
> > > > > > > > > > > otherwise
> > > > > > > > > > > your snort-inline is a "pass all".
> > > > > > > > > > >
> > > > > > > > > > > > Do I need to install ebtables for inline to disrupt traffic or
> > > > > > > > > > > > is
> > > > > > > > > > > > iptables, libnet, and libpcap all that I might need?
> > > > > > > > > > >
> > > > > > > > > > > AFAIK you don't need ebtables.  You do need libipq for inline
> > > > > > > > > > > and
> > > > > > > > > > > libnet.
> > > > > > > > > > > This is how snort-inline attaches to iptables by using libipq
> > > > > > > > > > > instead
> > > > > > > > > > > of
> > > > > > > > > > > using libpcap.
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > >  It is my impression that iptables just firewalls with static
> > > > > > > > > > > > rules.
> > > > > > > > > > >
> > > > > > > > > > > On it's own, yes, but IPTables is VERY extensible via libipq..
> > > > > > > > > > >
> > > > > > > > > > > That's where snort-inline comes in. Snort-inline interacts with
> > > > > > > > > > > iptables.
> > > > > > > > > > > It doesn't do things like create iptables rules to block
> > > > > > > > > > > packets,
> > > > > > > > > > > it
> > > > > > > > > > > the
> > > > > > > > > > > whole system becomes an iptables rule, it just happens to be a
> > > > > > > > > > > rule
> > > > > > > > > > > that
> > > > > > > > > > > runs snort instead of some simple expression.
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > > Do the snort rules running on the transparent inline snort box
> > > > > > > > > > > > reset
> > > > > > > > > > > > the
> > > > > > > > > > > > traffic that passes through using inline?
> > > > > > > > > > >
> > > > > > > > > > > Depends on if you use DROP or SDROP :).. However, inline doesn't
> > > > > > > > > > > JUST
> > > > > > > > > > > reset
> > > > > > > > > > > the traffic.. it also prevents the packet from being forwarded
> > > > > > > > > > > at
> > > > > > > > > > > all.
> > > > > > > > > > > DROP
> > > > > > > > > > > will also reset, SDROP won't.
> > > > > > > > > > >
> > > > > > > > > > > Snort 2.3's inline capacity is a direct port of snort-inline.
> > > > > > > > > > > You
> > > > > > > > > > > might
> > > > > > > > > > > want to check their FAQ for other info:
> > > > > > > > > > >
> > > > > > > > > > > http://snort-inline.sourceforge.net/FAQ.html
> > > > > > > > > > >
> > > > > > > > > > > -------------------------------------------------------
> > > > > > > > > > > SF email is sponsored by - The IT Product Guide
> > > > > > > > > > > Read honest & candid reviews on hundreds of IT Products from
> > > > > > > > > > > real
> > > > > > > > > > > users.
> > > > > > > > > > > Discover which products truly live up to the hype. Start reading
> > > > > > > > > > > now.
> > > > > > > > > > > http://productguide.itmanagersjournal.com/
> > > > > > > > > > > _______________________________________________
> > > > > > > > > > > Snort-users mailing list
> > > > > > > > > > > Snort-users () lists sourceforge net
> > > > > > > > > > > Go to this URL to change user options or unsubscribe:
> > > > > > > > > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > > > > > > > > Snort-users list archive:
> > > > > > > > > > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > -------------------------------------------------------
> > > > > > > > > > SF email is sponsored by - The IT Product Guide
> > > > > > > > > > Read honest & candid reviews on hundreds of IT Products from real
> > > > > > > > > > users.
> > > > > > > > > > Discover which products truly live up to the hype. Start reading
> > > > > > > > > > now.
> > > > > > > > > > http://productguide.itmanagersjournal.com/
> > > > > > > > > > _______________________________________________
> > > > > > > > > > Snort-users mailing list
> > > > > > > > > > Snort-users () lists sourceforge net
> > > > > > > > > > Go to this URL to change user options or unsubscribe:
> > > > > > > > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > > > > > > > Snort-users list archive:
> > > > > > > > > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> Best regards,
>
> Michael D. Peters
> Director of Security Services
> CISSP
> Lazarus Alliance Inc.
> M: 502-767-3448
> O: 502-231-8017 x8
> H: 502-231-6923
> F: 502-231-5347
>
> michael.peters () lazarusalliance com
> www.lazarusalliance.com
>
> Verify here: http://wwwkeys.us.pgp.net


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users