SnortSam Iptables

The Iptables plugin works on all linux box, iptables installed.

Default configuration is for any linux iptables-firewall with default DROP rule, and working with 2 interfaces:

eth0 = internal net

eth1 = external net

you can also change the target ethernet card by adding the correct ethX name on the snortsam.conf file.

The standard block command is:

iptables -I FORWARD -i eth1 -s {ip_addr_to_be_blocked} -j REJECT

The standard unblock command is:

iptables -D FORWARD -i eth1 -s {ip_addr_to_be_unblocked} -j REJECT

To start support for Iptables you have to add one line to the snortsam.conf like:

iptables eth1 log

You can also make your iptables block/unblock command by editing the module ssp_iptables.c (PAY ATTENTION AT THE CORRECT IPTABLES SYNTAX!!!) and then recompile it.

Fabrizio Tivano fabrizio@sad.it

-- MattJonkman - 09 Mar 2007