I have set the following rules in iptables:

sudo iptables -I INPUT -i eth0 -p tcp -s -j NFQUEUE
sudo iptables -I OUTPUT -p tcp --dport 3306 -j NFQUEUE

What I want to do is forward all Mysql traffic data to NFQ, and I wish to detect these data in Suricata, but these iptable rules not working as expected, only part of the data in NFQ goes into Suricata(or only part of data goes into NFQ). but when I set the following iptables:

sudo iptables -I INPUT -j NFQUEUE
sudo iptables -I OUTPUT -j NFQUEUE

This works well, all the packages go into NFQ and all detected by Suricata, but this iptable rule forward all the traffic onto NFQ, and this is not I want.

My question is how to set specific iptables rules only apply to Mysql protocol?


Check you have the NFQ kernel module loaded:

lsmod | grep nfnetlink_queue

Check to see if packets are matching those iptables rules

sudo iptables -vn -L

To just use the Suricata target for MySQL, the following should work:

sudo iptables -I INPUT -p tcp --dport 3306 -j NFQUEUE
sudo iptables -I OUTPUT -p tcp --sport 3306 -j NFQUEUE

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.