Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up a firewall with support for snort, and it is dropping all of my packets when I add the QUEUE target. I've made it like this, but the QUEUE target is not allowing the packets to be processed any further:

-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -j QUEUE 
-A INPUT -j ACCEPT

# It's not allowing anything past QUEUE, as you can see below in the count.
> iptables -I INPUT -nv
 pkts bytes target     prot opt in     out     source               destination         
 6707  395K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
  933  138K QUEUE      all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

I'm eventually going to change it to forward, but I'm just trying to get it working for now. I start snort like so:

snort -Q -D -c /etc/snort/snort.conf

EDIT: More Information

When I run it, it still sees the packets without having an iptables QUEUE target rule, but when I add a QUEUE target, it starts losing all of my packets.

# snort -Qc /etc/snort/snort.conf -N -A console
Enabling inline operation
Running in IDS mode

        --== Initializing Snort ==--
Initializing Output Plugins!
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file "/etc/snort/snort.conf"
## === CUT ===
***
*** interface device lookup found: bond0
***
Initializing Network Interface bond0
Decoding Ethernet on interface bond0
## === CUT ===
Not Using PCAP_FRAMES

So, it says inline, but the it says it's using bond0. Inline should not require an interface, right?

share|improve this question

1 Answer 1

It seems ip_queue module is loaded here. Do the following and check once:

modprobe ip_queue
modprobe iptable_filter

And then add the queue rule. Check this once if it works.

share|improve this answer
    
I'll have to try that out, if I can remember what I did. I had given up on this. –  bradlis7 Dec 23 '10 at 15:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.