[Day 10] 3. NFQueue and the IPS mode of Suricata

NFQueue:

NFQueue is a feature of Linux's Netfilter framework that allows packets to move from the kernel to user space. This lets applications like Suricata inspect and modify packets. If NFQueue support is missing, Suricata can't interact with iptables to inspect and block packets, so you won’t be able to proceed further.

Lab Setup:

• Debian 1: Suricata configured with iptables.
• Debian 2: Used to ping Debian 1.

Pre-requisite:

• Suricata must be configured on your system.

Steps to Set Up Suricata with NFQueue:

1. Check if Suricata has NFQueue support:

Run this command to verify:

bashCopy
suricata --build-info | grep NFQueue

You should see:

plaintextCopy
NFQueue support: yes

If it doesn’t show this, do not proceed.

2. Edit Suricata's

Copy

.yaml

configuration file:

Open Suricata's configuration file:

bashCopy
sudo nano /etc/suricata/suricata.yaml

Search for

nfq:

plaintextCopy
mode: accept
repeat-mark: 1
repeat-mask: 1
route-queue: 2

Uncomment these lines.

3. Install iptables:

Check if iptables is installed:

bashCopy
sudo which iptables

If not, install it:

bashCopy
sudo apt-get install iptables -y

Then add the following rules:

bashCopy
sudo iptables -I INPUT -p icmp -j NFQUEUE --queue-num 2
sudo iptables -I OUTPUT -p icmp -j NFQUEUE --queue-num 2

• Copy

  -I

  : Insert the rule.
• Copy

  -p

  : Specifies the protocol (ICMP in this case).
• Copy

  -j

  : Jumps to queue 2.

4. Add a rule in

Copy

local.rules

:

Edit Suricata’s local rules file:

bashCopy
sudo nano /etc/suricata/rules/local.rules

Add the following rule to block ICMP:

plaintextCopy
drop icmp any any -> any any (msg: "Kuch Bhi Block ICMP"; sid: 123; rev: 1;)

5. Stop Suricata:

Stop Suricata to apply changes:

bashCopy
sudo systemctl stop suricata
sudo systemctl status suricata

6. Run Suricata in IPS Mode:

Run Suricata to listen on queue 2:

bashCopy
sudo suricata -c /etc/suricata/suricata.yaml -q 2

7. Test with a Ping from the Second Machine:

On Debian 2, ping Debian 1:

bashCopy
ping <deb1_ip>

8. Check Suricata Logs:

Check Suricata logs to see the blocked ICMP packet:

bashCopy
sudo tail -f /var/log/suricata/fast.log

You should see the packet was sent to Debian 1 but was blocked, with the message "Kuch Bhi Block ICMP".