webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-12 20:16:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

suricata: Disable fail-open on NFQUEUE

Browse Source 
This change causes that if suricata crashes, the NFQUEUE will no longer
fall into a mode where ALL packets are being accepted. This used the be
the case before which opened the entire firewall.

If suricata randomly crashes, we will fall back to the "bypass" mode
where packets will bypass suricata, but nothing else.

Fixes: #13642
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer
2024-04-03 21:42:13 +01:00
parent bb46f3bef8
commit 69031f7674
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
config/suricata/suricata.yaml
View File

@@ -351,7 +351,7 @@ nfq:
bypass-mask: 1073741824
# route-queue: 2
# batchcount: 20
fail-open: yes
fail-open: no
##
## Step 5: App Layer Protocol Configuration