I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic.

Setup I am thinking about:
Snort computer with two NICs
One NIC connected to hub/tap outside firewall (WAN)
One NIC connected to hub/tap inside firewall (LAN)
Management from the Snort machine itself.

My question is:

This setup creates a physical path between the WAN and the LAN that bypasses the firewall. Could viruses or trojans or malware or other threats bypass the firewall and go from the WAN into the Snort machine and then to the LAN and affect LAN computers?

I have read about configuring the NICs with no IP addresses, but I have not been able to come to a conclusion about my question.

  • 2
    You appear to be asking "could the machine get infected, and can that machine pass the infection on?" Uh, yes to both. Even without IP addresses. Here's the question though: is it necessary for the Snort machine to transmit packets? If not, just block outgoing packets... – schroeder Oct 29 '17 at 14:20
  • Yes, that might do the trick... With Linux iptables I could perhaps do something like "iptables --policy OUTPUT DROP" and "iptables --policy FORWARD DROP" – Michael Oct 29 '17 at 16:18
  • The computer running snort can't effectively block infections on itself from sending traffic. Remember that if it were compromised, it could remove the iptables rule as easily as you added it. – Joseph Sible-Reinstate Monica Jul 27 '18 at 0:04

Generally speaking, yes, dual homed devices can - and often will - be used to create a pivot point for attackers.

Yet, your sniffing machine would be in a significantly less exposed position as maybe a server in a DMZ. On the other hand, parsing is hard and snort does exactly that; I am not confident to proclaim there are no vulnerabilities in snort. However, as you described, a physical connection is there so it very well could get infected and act as a pivot point into your network.

Besides using iptables to restrict the outbound network traffic of that machine, you might also consider using a data diode to ensure that behavior. Configurations on that machine might very well be changed when the attacker gains root; as simple as iptables -P OUTPUT ACCEPT. A data diode would still hold up any outbound traffic.

| improve this answer | |
  • Thank you for your reply SmokeDispenser. I have read up on diodes. Probably the most secure solution without a diode is to have two separate Snort machines physically apart with no connection whatsoever. But when I read articles about Snort I get the impression that WAN Snort machines are often configured with two NICs, one for snorting WAN and one for management from LAN. That creates the same kind of security problem as in my scenario. But this problem seems not to be discussed very much. – Michael Oct 29 '17 at 21:10
  • Well; being blind on the LAN side has it’s downsides. And yes, this is rarely discussed indeed. Thus my answer here instead of not answering at all:) – Tobi Nary Oct 29 '17 at 21:15

In its most basic form, when a Snort machine is being used as an IDS, then the requirement for a 2nd NIC is not there except for redundancy. When used as an IPS then the Snort engine is being used to decide if the packets are to be dropped so in this case there is a requirement to have that 2nd NIC.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.