Suricata IPS iptables - Versionsgeschichte

Thomas.will: Die Seite wurde geleert.

2025-04-23T05:38:29Z

Die Seite wurde geleert.

2025-04-23T05:37:11Z

iptables Version

2025-04-23T05:36:56Z

iptables Version

2025-04-23T05:35:27Z

nftables Version

2025-04-23T05:34:40Z

nftables Version

2025-04-23T05:32:50Z

iptables Version

2025-03-10T21:01:23Z

iptables Version

2025-03-10T20:33:57Z

Local Rules

2025-03-10T20:33:15Z

iptables Version

2025-03-10T20:32:55Z

Konfiguration Suricata

@@ Zeile 213: / Zeile 213: @@
   iptables -A FORWARD -m mark ! --mark ''1''/'''1''' -j NFQUEUE
   iptables -A FORWARD -j LOG --log-prefix "iptables return from Suricata: "
 == nftables Version ==

@@ Zeile 210: / Zeile 210: @@
   iptables -P FORWARD DROP
   iptables -A FORWARD -m mark ! --mark ''1''/'''1''' -j NFQUEUE
   iptables -A FORWARD -j LOG --log-prefix "iptables return from Suricata: "
- iptables -A FORWARD -j ACCEPT
 == nftables Version ==
 * '''vim /etc/nftables.conf'''

@@ Zeile 220: / Zeile 220: @@
    chain forward {
      type filter hook forward priority 0; policy drop;
      # An Suricata übergeben, wenn Mark-Bit 0 nicht gesetzt
      meta mark and 1 != 1 queue

@@ Zeile 219: / Zeile 219: @@
 table inet filter {
    chain forward {
-     type filter hook forward priority 0;
+     type filter hook forward priority 0; policy drop;
      # An Suricata übergeben, wenn Mark-Bit 0 nicht gesetzt
      meta mark and 1 != 1 queue
      # Logging und Akzeptanz nach Rückgabe durch Suricata (mit gesetztem Mark)
      log prefix "nftables return from Suricata: "
-     accept
+     ...
+   }
+}

@@ Zeile 213: / Zeile 213: @@
   iptables -A FORWARD -j LOG --log-prefix "iptables return from Suricata: "
   iptables -A FORWARD -j ACCEPT
 == Suricata Anpassung ==

@@ Zeile 191: / Zeile 191: @@
 *cat /etc/suricata/rules/local.rules
 alert icmp any any -> any any (msg:"ICMP Test"; flow:to_server; sid:1;)
 drop http any any -> any any (msg: "SQL Injection Attempt!"; flow:established,to_server; http.request_body; content: "OR 1=1"; sid:2;)
@@ Zeile 196: / Zeile 197: @@
 drop http any any -> any any (msg: "Possible SQL Injection attack (Contains singlequote POST DATA)"; flow:established,to_server; content:"%27"; nocase; http_client_body; sid:4;)
 drop http any any -> any any (msg: "Possible Command Injection attack (Contains semicolon POST DATA)"; flow:established,to_server; content:"%3B"; nocase; http_client_body; sid:5;)
 = Firewallanpassung =

@@ Zeile 212: / Zeile 212: @@
   iptables -A FORWARD -p icmp -j ACCEPT
   ...
 == Suricata Anpassung ==

@@ Zeile 28: / Zeile 28: @@
      INT: "[$LAN,$DMZ]"
      EXTERNAL_NET: "!$INT"
 # Standard-Log-Verzeichnis
@@ Zeile 178: / Zeile 185: @@
      imap:
        enabled: yes
-−
 </pre>