I run a Centos 6.5 server with a highly restrictive iptables
ruleset allowing incoming traffic only on a small handful of tcp ports (8 in total) and blocks all incoming unsolicited UDP traffic.
I recently built snort 2.9.7.0 from source and am running it in policy_mode:inline-test
I notice it's alerting on packets that are blocked by my iptables
configuration, from which I surmise it's inserted itself in the processing chain before iptables
.
I have read the manual and done several web searches but can find no mention of this behavior, or how to configure it so it runs after iptables. I don't believe I need alerts on traffic that will be blocked anyway.
Is there a reason I would want to see those alerts, and if not, is there a way to set things up so I don't get alerts for iptables-blocked packets?