webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-28 03:33:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

suricata: Use highest bit to mark packets

Browse Source 
We are using the netfilter MARK in IPsec & QoS and this
is causing conflicts.

Therefore, we use the highest bit in the IPS chain now
and clear it afterwards because we do not really care about
this after the packets have been passed through suricata.

Then, no other application has to worry about suricata.

Fixes: #12010
Signed-off-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
This commit is contained in:
Michael Tremer
2019-02-28 19:37:38 +00:00
committed by Stefan Schantl
parent c9ee3592f0
commit 5d04cfe7d5
2 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
config/suricata/suricata.yaml
View File

@@ -117,8 +117,8 @@ logging:
nfq:
mode: repeat
repeat-mark: 16
repeat-mask: 16
repeat-mark: 1879048192
repeat-mask: 1879048192
# bypass-mark: 1
# bypass-mask: 1
# route-queue: 2