I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've used is here -> Snort 3.0.1 on Ubuntu 18 & 20

I've built a local network which to simulate a real use case. For simplicity I'd like to focus on IPS protection and simple routing. The network I'm trying is below:

enter image description here

Now that I can perfectly configure the iptables to forward the outside( network to inside network ( with such commands:

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination
sudo iptables -t nat -A POSTROUTING -o enp0s1 -j MASQUERADE

Seperately, I can redirect the outside( network to Snort's NFQUEUE

sudo iptables -I FORWARD -j NFQUEUE --queue-num=4
sudo snort -c /usr/local/etc/snort/snort.lua -L dump --daq afpacket --daq-var queue=4 -i enp0s1:enp0s2

Unfortunately I'm having a hard time to understand to combine these both commands to use Snort as complete IPS tool. So in short how I can make Snort to forward inspected 'secure' client packet to the webserver then back(of course).

Much appreciated


IPS seems not to work without a bridge, right? Here is a docker setup that may work.

This is my iptables entry:

111  5788 DNAT tcp -- eth0 *  tcp dpt:8081 to:
  • I created PR with my current docker setup => I am not sure if your question is directly related => github.com/cfinkelstein/myownlab/pull/1/files. What we actually need is NFQ for NAT communication - this is what I understood so far.
    – Conrad
    Mar 25 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.