1FWSNORT(8) System Manager's Manual FWSNORT(8)
2
6 fwsnort - Firewall Snort
7
9 fwsnort [options]
10
12 fwsnort translates SNORT rules into iptables rules on Linux systems and
13 generates a shell script that implements the resulting iptables com‐
14 mands. This ruleset allows network traffic that matches Snort signa‐
15 tures (i.e. attacks and other suspicious network behavior) to be
16 logged and/or dropped by iptables directly without putting an interface
17 into promiscuous mode or queuing packets from kernel to user space.
18 Note that fwsnort can also build an iptables policy that combines the
19 string match extension with the NFQUEUE or QUEUE targets to allow the
20 kernel to perform preliminary string matches that are defined within
21 Snort rules before queuing matching packets to a userspace snort_inline
22 instance. Because the bulk of network communications are not mali‐
23 cious, this should provide a speedup for snort_inline since the major‐
24 ity of packets do not then have to be copied from kernel memory into
25 user memory and subsequently inspected by snort_inline. There is a
26 tradeoff here in terms of signature detection however because
27 snort_inline when deployed in this way does not have the opportunity to
28 see all packets associated with a session, so stream reassembly and
29 signature comparisons against a reassembled buffer do not take place
30 (the stream preprocessor should be disabled in the userspace
31 snort_inline instance).
32 As of fwsnort-1.5 all iptables rules built by fwsnort are written out
34 to the /etc/fwsnort/fwsnort.save file in iptables-save format. This
35 allows a long fwsnort policy (which may contain thousands of iptables
36 rules translated from a large Snort signature set) to be quickly
37 instantiated via the "iptables-restore" command. A wrapper script
38 /etc/fwsnort/fwsnort.sh is also written out to make this easy. Hence,
39 the typical work flow for fwsnort is to: 1) run fwsnort, 2) note the
40 Snort rules that fwsnort was able to successfully translate (the number
41 of such rules is printed to stdout), and then 3) execute the /etc/fws‐
42 nort/fwsnort.sh wrapper script to instantiate the policy in the running
43 kernel.
44 fwsnort (optionally) uses the IPTables::Parse CPAN module to parse the
46 iptables ruleset on the machine to determine which Snort rules are
47 applicable to the specific iptables policy. After all, if iptables is
48 blocking all inbound http traffic from external addresses for example,
49 it is probably not of much use to try detecting inbound attacks against
50 against tcp/80. By default fwsnort generates iptables rules that log
51 Snort sid's within a --log-prefix to syslog where the messages can be
52 analyzed with a log analyzer such as psad (see http://www.cipher‐
53 dyne.org/psad/). fwsnort relies on the iptables string match module to
54 match Snort content fields in the application portion of ip traffic.
55 Since Snort rules can contain hex data in content fields (specified
56 between pipe "|" characters), fwsnort implements a patch against ipta‐
57 bles (which has been accepted by the Netfilter project as of ipta‐
58 bles-1.2.7a) which adds a "--hex-string" option. This allow iptables
59 to accept content fields from Snort rules such as
60 "|0d0a5b52504c5d3030320d0a|" without any modification. fwsnort is able
61 to translate approximately 60% of all rules from the Snort-2.3.3 IDS
62 into equivalent iptables rules. For more information about the trans‐
63 lation strategy as well as advantages/disadvantages of the method used
64 by fwsnort to obtain intrusion detection data, see the README included
65 with the fwsnort sources or browse to: http://www.cipherdyne.org/fws‐
66 nort/
67 fwsnort is able to apply Snort rules to IPv6 traffic by building an
69 ip6tables policy (see the "--ip6tables" command line argument).
70
72 -c, --config <configuration file>
73 By default fwsnort makes use of the configuration file /etc/fws‐
74 nort/fwsnort.conf for almost all configuration parameters. fws‐
75 nort can be made to override this path by specifying a different
76 file on the command line with the --config option.
77 --update-rules
79 Download the latest Emerging Threats rules from
80 http://www.emergingthreats.net This will overwrite the emerg‐
81 ing-all.rules file in the /etc/fwsnort/snort_rules/ directory.
82 Note that the automatic downloading of Snort rules from
83 http://www.snort.org/ as of March, 2005 is only offered as a pay
84 service.
85 --rules-url <url>
87 Specify the URL to use when updating the Emerging Threats rule
88 set (or any other rule set). The default URL is:
89 http://rules.emergingthreats.net/open/snort-2.9.0/emerging-
90 all.rules
91 -6, --ip6tables
93 Enable ip6tables mode so that the fwsnort rule set is built into
94 an ip6tables policy instead of the iptables policy. This allows
95 fwsnort controls to apply to IPv6 traffic.
96 --include-type <rules type>
98 Restrict to processing snort rules of <rules type>. Example
99 rule types would include "ddos", "backdoor", and "web-attacks".
100 This option also supports a comma-separated list of types, e.g.
101 "ddos,backdoor".
102 --exclude-type <rules type>
104 Exclude all Snort rules from of type <rules type> from the
105 translation process. For example, if you don't want any rules
106 from the file emerging-all.rules to be translated, then use
107 "emerging-all" as the argument to this option. A comma-sepa‐
108 rated list of types to exclude can be specified.
109 --include-regex <regex>
111 Only translate Snort rules that match the specified regular
112 expression. This is useful to build fwsnort policies for Snort
113 rules that have a common characteristic (such as a string match
114 on the word "Storm" for the Storm worm for example).
115 --exclude-regex <regex>
117 Translate all Snort rules except those that match the specified
118 regular expression. This is useful to omit Snort rules from
119 fwsnort policies that have a common characteristic (such as a
120 string match on "HTTP_PORTS" for example).
121 --include-re-caseless
123 Make the rule matchine regular expression specified with
124 --include-regex match case insensitively.
125 --exclude-re-caseless
127 Make the rule matchine regular expression specified with
128 --exclude-regex match case insensitively.
129 --snort-rdir <snort-rules-directory>
131 Manually specify the directory where the snort rules files are
132 located. The default is /etc/fwsnort/snort_rules. Multiple
133 directories are supported as a comma-separated list.
134 --snort-rfile <snort-rules-file>
136 Manually specify a Snort rules file to translated into iptables
137 rules. Multiple files are also supported as a comma-separated
138 list.
139 --snort-sid <sid>
141 Generate an iptables ruleset for a single snort rule specified
142 by <sid>. A comma-separated list of sids can be specified, e.g.
143 "2001842,1834".
144 --exclude-sid <sid>
146 Provide a list of Snort ID's to be excluded from the translation
147 process.
148 --include-perl-triggers
150 Include 'perl -e print ... ' commands as comments in the fws‐
151 nort.sh script. These commands allow payloads that are designed
152 to trigger snort rules to easily be built, and when combined
153 with netcat (or other software that can send bytes over the
154 wire) it becomes possible to test whether an fwsnort policy
155 appropriately triggers on matching traffic.
156 --ipt-script <script file>
158 Specify the path to the iptables script generated by fwsnort.
159 The default location is /etc/fwsnort/fwsnort.sh.
160 --ipt-check-capabilities
162 Check iptables capabilities and exit.
163 --Last-cmd
165 Run fwsnort with the same command line arguments as the previous
166 execution. This is a convenient way of rebuilding the /etc/fws‐
167 nort/fwsnort.sh script without having to remember what the last
168 command line args were.
169 --NFQUEUE
171 Build an fwsnort policy that sends packets that match Snort con‐
172 tent or uricontent fields to userspace via the iptables NFQUEUE
173 target for further analysis. This is a mechanism for reducing
174 the signature inspection load placed on snort_inline. A paral‐
175 lel set of Snort rules that are successfully translated are
176 placed in the /etc/fwsnort/snort_rules_queue directory. This
177 requires CONFIG_NETFILTER_XT_TARGET_NFQUEUE support in the Linux
178 kernel.
179 --QUEUE
181 Same as the --NFQUEUE command line argument except that the
182 older QUEUE target is used instead of the NFQUEUE target. This
183 requires CONFIG_IP_NF_QUEUE support in the Linux kernel.
184 --queue-num <num>
186 Specify a queue number in --NFQUEUE mode.
187 --queue-pre-match-max <num>
189 In --QUEUE or --NFQUEUE mode, limit the number of content
190 matches that are performed within the kernel before sending a
191 matching packet to a userspace Snort instance. This allows a
192 level of tuning with respect to how much work the kernel does to
193 qualify a packet based on a signature match before having Snort
194 do the same thing. The default is to perform all specified con‐
195 tent matches in the signature before queuing the packet to
196 userspace because the multiple in-kernel content matches is
197 probably less expensive than sending a packet to userspace by
198 default.
199 --string-match-alg <alg>
201 Specify the string matching algorithm to use with the kernel.
202 By default, this is 'bm' for the 'Boyer-Moore' string matching
203 algorithm, but 'kmp' may also be specified (short for the
204 'Knuth–Morris–Pratt' algorithm).
205 --ipt-apply
207 Execute the iptables script generated by fwsnort.
208 --ipt-flush
210 Flush all fwsnort currently active iptables rules (flushes the
211 fwsnort chains).
212 --ipt-list
214 List all fwsnort currently active iptables rules (lists the fws‐
215 nort chains).
216 --ipt-drop
218 For each logging rule generated by fwsnort add a corresponding
219 DROP rule. Note that for TCP sessions using this option will
220 cause retransmissions as packets that are part of established
221 sessions selectively dropped. Remember that false positives are
222 common occurrences for intrusion detection systems, and so using
223 this or the --ipt-reject option may break things on your net‐
224 work! You have been warned.
225 --ipt-reject
227 For each logging rule generated by fwsnort add a corresponding
228 REJECT rule. Reset packets will be generated for TCP sessions
229 through the use of the "--reject-with tcp-reset" option, and
230 ICMP port unreachable messages will be generated for UDP packets
231 through the use of the "--reject-with icmp-port-unreachable"
232 option.
233 -C, --Conntrack-state <state>
235 Specify a conntrack state in place of the "established" state
236 that commonly accompanies the Snort "flow" keyword. By default,
237 fwsnort uses the conntrack state of "ESTABLISHED" for this. In
238 certain corner cases, it might be useful to use "ESTAB‐
239 LISHED,RELATED" instead to apply application layer inspection to
240 things like ICMP port unreachable messages that are responses to
241 real attempted communications.
242 --no-ipt-log
244 By default fwsnort generates an iptables script that implements
245 a logging rule for each successfully translated snort rule.
246 This can be disabled with the --no-ipt-log option, but --ipt-
247 drop must also be specified.
248 --no-ipt-sync
250 Do not consult the iptables policy currently running on the
251 machine for applicable snort rules. Unless limited with the
252 --include-type or --snort-sid options this can result in a fws‐
253 nort.sh script that contains several thousand iptables rules.
254 --no-ipt-test
256 Do not test the iptables build for existence of support for the
257 LOG and REJECT targets, and ascii and hex string matching.
258 --no-ipt-jumps
260 Do not jump packets from the built-in iptables INPUT, OUTPUT,
261 and FORWARD chains to the custom fwsnort chains. This options
262 is mostly useful to make it easy to manually alter the placement
263 of the jump rules in the iptables ruleset.
264 --no-ipt-rule-nums
266 By default fwsnort includes the rule number within the logging
267 prefix for each of the rules it adds to the fwsnort chains.
268 E.g. the logging prefix for rule 34 would look something like
269 "[34] SID1242 ESTAB". Use this option to not include the rule
270 number.
271 --no-ipt-comments
273 If the iptables "comment" match exists, then fwsnort puts the
274 Snort "msg", "classtype", "reference", "priority", and "rev"
275 fields within a comment for each iptables rule. Use this option
276 to disable this.
277 --no-ipt-INPUT
279 Do not jump packets from the iptables INPUT chain to the fwsnort
280 chains.
281 --no-ipt-OUTPUT
283 Do not jump packets from the iptables OUTPUT chain to the fws‐
284 nort chains.
285 --no-ipt-FORWARD
287 Do not jump packets from the iptables FORWARD chain to the fws‐
288 nort chains.
289 --no-fast-pattern-ordering
291 Cause fwsnort to not try to reorder pattern matches to process
292 the longest pattern first. The Snort fast_pattern keyword is
293 also ignored if this option is specified.
294 -H, --Home-net <network/mask>
296 Specify the internal network instead of having fwsnort derive it
297 from the HOME_NET keyword in the fwsnort.conf configuration
298 file.
299 -E, --External-net <network/mask>
301 Specify the external network instead of having fwsnort derive it
302 from the EXTERNAL_NET keyword in the fwsnort.conf configuration
303 file.
304 --no-addresses
306 Disable all checks against the output of ifconfig for proper IP
307 addresses. This is useful if fwsnort is running on a bridging
308 firewall.
309 --Dump-conf
311 Print the fwsnort configuration on STDOUT and exit.
312 --debug
314 Run in debug mode. This will cause all parse errors which are
315 normally written to the fwsnort logfile /var/log/fwsnort.log to
316 be written to STDOUT instead.
317 --strict
319 Run fwsnort in "strict" mode. This will prevent fwsnort from
320 translating snort rules that contain the keywords "offset",
321 "uricontent", and "depth".
322 -U, --Ulog
324 Force the usage of the ULOG target for all log messages instead
325 of the default LOG target.
326 --ulog-nlgroup
328 Specify the netlink group for ULOG rules. Such rules are only
329 added for Snort rules that have an action of "log", or when fws‐
330 nort is run in --Ulog mode.
331 -l, --logfile <logfile>
333 By default fwsnort logs all parse errors to the logfile
334 /var/log/fwsnort.log. This path can be manually changed with
335 the --logfile option.
336 -v, --verbose
338 Run fwsnort in verbose mode. This will cause fwsnort to add the
339 original snort rule as a comment to the fwsnort.sh script for
340 each successfully translated rule.
341 -V, --Version
343 Print the fwsnort version and exit.
344 -h, --help
346 Print usage information on STDOUT and exit.
347
349 /etc/fwnort/fwsnort.conf
350 The fwsnort configuration file. The path to this file can be
351 changed on the command line with --config.
352 /etc/fwnort/fwsnort.sh
354 The iptables script generated by fwsnort. The path can be manu‐
355 ally specified on the command line with the --ipt-script option.
356
358 This section describes what each of the more important fwsnort configu‐
359 ration variables do and how they can be tuned to meet your needs.
360 These variables are located in the fwsnort configuration file /etc/fws‐
361 nort/fwsnort.conf
362 HOME_NET
364 fwsnort uses the same HOME_NET and EXTERNAL_NET variables as
365 defined in Snort rules, and the same semantics are supported.
366 I.e., individual IP addresses or networks in standard dotted-
367 quad or CIDR notation can be specified, and comma separated
368 lists are also supported.
369 EXTERNAL_NET
371 Defines the external network. See the HOME_NET variable for
372 more information.
373
375 The following examples illustrate the command line arguments that could
376 be supplied to fwsnort in a few situations:
377 Script generation in logging mode, parse errors written to the fwsnort
379 logfile, and iptables policy checking are enabled by default without
380 having to specify any command line arguments:
381 # fwsnort
383 Generate ip6tables rules for attacks delivered over IPv6:
385 # fwsnort -6
387 Generate iptables rules for ddos and backdoor Snort rules only:
389 # fwsnort --include-type ddos,backdoor
391 Generate iptables rules for Snort ID's 2008475 and 2003268 (from emerg‐
393 ing-all.rules):
394 fwsnort --snort-sid 2008475,2003268
396 Generate iptables rules for Snort ID's 1834 and 2001842 but queue them
398 to userspace via the NFQUEUE target and restrict exclude the INPUT and
399 OUTPUT chains:
400 fwsnort --snort-sid 1834,2001842 --NFQUEUE --no-ipt-INPUT --no-ipt-OUT‐
402 PUT
403 Instruct fwsnort to only inspect traffic that traverses the eth0 and
405 eth1 interfaces:
406 # fwsnort --restrict-intf eth0,eth1
408 Generate iptables rules for all Snort rules, and write original snort
410 rule to the iptables script as a comment:
411 # fwsnort --no-ipt-sync --verbose
413
415 fwsnort requires that the iptables string match module be compiled into
416 the kernel (or as a loadable kernel module) in order to be able to
417 match snort signatures that make use of the "content" keyword. Note
418 that the --no-opt-test option can be specified to have fwsnort generate
419 an iptables script even if the string match module is not compiled in.
420 fwsnort also requires the IPTables::Parse CPAN module in order to parse
422 iptables policies. This module is bundled with the fwsnort sources in
423 the deps/ directory for convenience.
424
426 The --debug option can be used to display on STDOUT any errors that are
427 generated as fwsnort parses each snort rule. Normally these errors are
428 written to the fwsnort logfile /var/log/fwsnort.log
429
431 psad(8), iptables(8), snort(8), nmap(1)
432
434 Michael Rash <mbr@cipherdyne.org>
435
437 Many people who are active in the open source community have contrib‐
438 uted to fwsnort; see the CREDITS file in the fwsnort sources, or visit
439 http://www.cipherdyne.org/fwsnort/docs/contributors.html to view the
440 online list of contributors.
441 fwsnort is based on the original snort2iptables script written by
443 William Stearns.
444
446 Send bug reports to mbr@cipherdyne.org. Suggestions and/or comments are
447 always welcome as well.
448
450 fwsnort is distributed under the GNU General Public License (GPLv2),
451 and the latest version may be downloaded from http://www.cipher‐
452 dyne.org/ Snort is a registered trademark of Sourcefire, Inc.
453Linux Jan, 2011 FWSNORT(8)