hello, I need some help to get snort3 to work properbly. I have read severeall threads and they are so different and none of them works.
I figured out that my test rule doesn't work at all, so why not? There must be something wrong...
here are my config files:
/etc/config/firewall:
...
config include
option enabled '1'
option type 'script'
option path '/etc/snort/snort-table.sh'
option fw4_compatible '1'
/etc/snort/snort-table.sh:
#!/bin/sh
verbose=false
nft list tables | grep -q 'snort' && nft flush table inet snort
nft -f - <<TABLE
table inet snort {
chain IPS {
type filter hook forward priority filter; policy accept;
counter queue flags bypass to 4-6
# meta l4proto tcp counter queue flags bypass to 4
# meta l4proto udp counter queue flags bypass to 5
# meta l4proto != { tcp, udp } counter queue flags bypass to 6
}
}
TABLE
$verbose && nft list table inet snort
exit 0
/etc/init.d/snort:
#!/bin/sh /etc/rc.common
START=99
STOP=10
USE_PROCD=1
PROG=/usr/bin/snort
validate_snort_section() {
uci_validate_section snort snort "${1}" \
'config_dir:string' \
'interface:string'
}
start_service() {
local config_file interface
validate_snort_section snort || {
echo "validation failed"
return 1
}
procd_open_instance
procd_set_param command $PROG -q -i "$interface" -c "${config_dir%/}/snort.lua" --tweaks local
procd_set_param env SNORT_LUA_PATH="$config_dir"
procd_set_param file $CONFIGFILE
procd_set_param respawn
procd_close_instance
}
stop_service()
{
service_stop ${PROG}
}
service_triggers()
{
procd_add_reload_trigger "snort"
procd_add_validation validate_snort_section
}
/etc/snort/local.lua:
-- use ths file to customize any functions defined in /etc/snort/snort.lua
-- switch tap to inline in ips and uncomment the below to run snort in inline mode
snort = {}
snort["-Q"] = true
ips = {
-- mode = tap,
mode = inline,
variables = default_variables,
action_override = drop,
-- uncomment and change the below to reflect rules or symlinks to rules on your filesystem
include = RULE_PATH .. '/snort.rules',
include = RULE_PATH .. '/snort3-community-rules/snort3-community.rules',
include = RULE_PATH .. '/snort3-registered-rules/includes.rules',
}
daq = {
module_dirs = {
'/usr/lib/daq',
},
modules = {
{
name = 'afpacket',
mode = 'inline',
}
}
}
alert_syslog = {
level = 'info',
}
-- To log to a file, uncomment the below and manually create the dir defined in output.logdir
output.logdir = '/var/log/snort'
alert_fast = {
file = true,
packet = false,
}
normalizer = {
tcp = {
ips = true,
}
}
file_policy = {
enable_type = true,
enable_signature = true,
rules = {
use = {
verdict = 'log', enable_file_type = true, enable_file_signature = true
}
}
}
-- To use openappid with snort, install the openappid package and uncomment the below
--appid = {
-- app_detector_dir = '/usr/lib/openappid',
-- log_stats = true,
-- app_stats_period = 60,
--}
/etc/snort/homenet.lua:
-- setup HOME_NET below with your IP range/ranges to protect
HOME_NET = [[ 192.168.0.0/24 192.168.3.0/24 192.168.4.0/24 ]]
EXTERNAL_NET = "!$HOME_NET"
thx!
