webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

suricata: Add whitelist to iptables

Browse Source 
This allows us to workaround better against any problems in Suricata
because we never send any whitelisted packets to the IPS in the first
place.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer
2024-09-09 12:46:23 +02:00
parent 655a95803a
commit 84a73d5f39
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/initscripts/system/suricata
View File

@@ -75,6 +75,21 @@ generate_fw_rules() {
# Don't process packets that have already been seen by the IPS
iptables -w -t mangle -A IPS -m mark --mark "$(( IPS_REPEAT_MARK ))/$(( IPS_REPEAT_MASK ))" -j RETURN
# Never send any whitelisted packets to the IPS
if [ -r "/var/ipfire/suricata/ignored" ]; then
local id network remark enabled rest
while IFS=',' read -r id network remark enabled rest; do
echo "$network"
echo "$remark"
# Skip disabled entries
[ "${enabled}" = "enabled" ] || continue
iptables -w -t mangle -A IPS -s "${network}" -j RETURN
iptables -w -t mangle -A IPS -d "${network}" -j RETURN
done < "/var/ipfire/suricata/ignored"
fi
# Send packets to suricata
iptables -w -t mangle -A IPS -j NFQUEUE "${NFQ_OPTIONS[@]}"