FWSNORT(8)

📦 version 1.6.8, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 FWSNORT(8) 💖

okay so first things first, this is the manual page for fwsnort, from the System Manager's Manual. bestie, buckle up, it's giving firewall sorcery ✨

🌸 NAME 🌸

fwsnort — Firewall Snort 🫶

🎀 SYNOPSIS 🎀

fwsnort [options]

🦋 DESCRIPTION 🦋

so like, fwsnort translates SNORT rules into iptables rules on Linux systems and generates a corresponding iptables policy in iptables-save format. This ruleset lets network traffic that matches Snort signatures (aka attacks and other suspicious network behavior) be logged and/or dropped by iptables directly without putting an interface into promiscuous mode or queuing packets from kernel to user space. 💅

ngl, fwsnort can also build an iptables policy that combines the string match extension with the NFQUEUE or QUEUE targets, so the kernel does preliminary string matches defined inside Snort rules before queuing matching packets to a userspace snort_inline instance. Because the bulk of network communications are not generally malicious, this should provide a speedup for snort_inline since the majority of packets do not then have to be copied from kernel memory into user memory and subsequently inspected by snort_inline. 🏃‍♀️💨

⚠️ but there's a tradeoff here in terms of signature detection, bestie — because snort_inline deployed this way does not have the opportunity to see all packets associated with a session, so stream reassembly and signature comparisons against a reassembled buffer do not take place (the stream preprocessor should be disabled in the userspace snort_inline instance). 😭

as of fwsnort-1.5, all iptables rules built by fwsnort are written out to the /var/lib/fwsnort/fwsnort.save file in iptables-save format. This allows a long fwsnort policy (which may contain thousands of iptables rules translated from a large Snort signature set) to be quickly instantiated via the "iptables-restore" command. A wrapper script /var/lib/fwsnort/fwsnort.sh is also written out to make this easy. 🌈

hence, the typical work flow for fwsnort is to:

  1. run fwsnort
  2. note the Snort rules that fwsnort was able to successfully translate (the number of such rules is printed to stdout)
  3. execute the /var/lib/fwsnort/fwsnort.sh wrapper script to instantiate the policy in the running kernel

fwsnort (optionally) uses the IPTables::Parse CPAN module to parse the iptables ruleset on the machine to determine which Snort rules are applicable to the specific iptables policy. after all, if iptables is blocking all inbound http traffic from external addresses for example, it is probably not of much use to try detecting inbound attacks against against tcp/80. 🤷‍♀️

by default fwsnort generates iptables rules that log Snort sid's within a --log-prefix to syslog where the messages can be analyzed with a log analyzer such as psad (see http://www.cipherdyne.org/psad/). fwsnort relies on the iptables string match module to match Snort content fields in the application portion of ip traffic. 👑

since Snort rules can contain hex data in content fields (specified between pipe "|" characters), fwsnort implements a patch against iptables (which has been accepted by the Netfilter project as of iptables-1.2.7a) which adds a "--hex-string" option. This allows iptables to accept content fields from Snort rules such as "|0d0a5b52504c5d3030320d0a|" without any modification. 🧚

fwsnort is able to translate approximately 60% of all rules from the Snort-2.3.3 IDS into equivalent iptables rules. for more information about the translation strategy as well as advantages/disadvantages of the method used by fwsnort to obtain intrusion detection data, see the README included with the fwsnort sources or browse to: http://www.cipherdyne.org/fwsnort/ ✨

fwsnort is able to apply Snort rules to IPv6 traffic by building an ip6tables policy (see the "--ip6tables" command line argument). 💜

💅 OPTIONS 💅

  • -c, --config <configuration file> — by default fwsnort makes use of the configuration file /etc/fwsnort/fwsnort.conf for almost all configuration parameters. fwsnort can be made to override this path by specifying a different file on the command line with the --config option. when fwsnort is not executed as root, then a path to a readable fwsnort.conf file is required. 🔐
  • --update-rules — download the latest Emerging Threats rules from http://www.emergingthreats.net 🌐 This will overwrite the emerging-all.rules file in the /etc/fwsnort/snort_rules/ directory. note that the automatic downloading of Snort rules from http://www.snort.org/ as of March, 2005 is only offered as a pay service. 💸
  • --rules-url <url> — specify the URL to use when updating the Emerging Threats rule set (or any other rule set). the default URL is: http://rules.emergingthreats.net/open/snort-2.9.0/emerging-all.rules
  • -6, --ip6tables — enable ip6tables mode so that the fwsnort rule set is built into an ip6tables policy instead of the iptables policy. this allows fwsnort controls to apply to IPv6 traffic. 🌈
  • --include-type <rules type> — restrict to processing snort rules of <rules type>. example rule types would include "ddos", "backdoor", and "web-attacks". this option also supports a comma-separated list of types, e.g. "ddos,backdoor". 🎯
  • --exclude-type <rules type> — exclude all Snort rules of type <rules type> from the translation process. for example, if you don't want any rules from the file emerging-all.rules to be translated, then use "emerging-all" as the argument to this option. a comma-separated list of types to exclude can be specified. 🚫
  • --include-regex <regex> — only translate Snort rules that match the specified regular expression. this is useful to build fwsnort policies for Snort rules that have a common characteristic (such as a string match on the word "Storm" for the Storm worm for example). 🔍
  • --exclude-regex <regex> — translate all Snort rules except those that match the specified regular expression. this is useful to omit Snort rules from fwsnort policies that have a common characteristic (such as a string match on "HTTP_PORTS" for example). 🙅‍♀️
  • --include-re-caseless — make the rule matching regular expression specified with --include-regex match case insensitively. 🔤
  • --exclude-re-caseless — make the rule matching regular expression specified with --exclude-regex match case insensitively. 🔤
  • --snort-rdir <snort-rules-directory> — manually specify the directory where the snort rules files are located. the default is /etc/fwsnort/snort_rules. multiple directories are supported as a comma-separated list. 📁
  • --snort-rfile <snort-rules-file> — manually specify a Snort rules file to translated into iptables rules. multiple files are also supported as a comma-separated list. 📄
  • --snort-sid <sid> — generate an iptables ruleset for a single snort rule specified by <sid>. a comma-separated list of sids can be specified, e.g. "2001842,1834". 🆔
  • --exclude-sid <sid> — provide a list of Snort ID's to be excluded from the translation process. ✂️
  • --include-perl-triggers — include 'perl -e print ... ' commands as comments in the fwsnort.sh script. these commands allow payloads that are designed to trigger snort rules to easily be built, and when combined with netcat (or other software that can send bytes over the wire) it becomes possible to test whether an fwsnort policy appropriately triggers on matching traffic. 🧪
  • --ipt-script <script file> — specify the path to the iptables script generated by fwsnort. the default location is /var/lib/fwsnort/fwsnort.sh. 📜
  • --ipt-check-capabilities — check iptables capabilities and exit. ✅
  • --Last-cmd — run fwsnort with the same command line arguments as the previous execution. this is a convenient way of rebuilding the /var/lib/fwsnort/fwsnort.sh script without having to remember what the last command line args were. 🧠
  • --NFQUEUE — build an fwsnort policy that sends packets that match Snort content or uricontent fields to userspace via the iptables NFQUEUE target for further analysis. this is a mechanism for reducing the signature inspection load placed on snort_inline. a parallel set of Snort rules that are successfully translated are placed in the /etc/fwsnort/snort_rules_queue directory. this requires CONFIG_NETFILTER_XT_TARGET_NFQUEUE support in the Linux kernel. 🐧
  • --QUEUE — same as the --NFQUEUE command line argument except that the older QUEUE target is used instead of the NFQUEUE target. this requires CONFIG_IP_NF_QUEUE support in the Linux kernel. 🐧
  • --queue-num <num> — specify a queue number in --NFQUEUE mode. 🔢
  • --queue-pre-match-max <num> — in --QUEUE or --NFQUEUE mode, limit the number of content matches that are performed within the kernel before sending a matching packet to a userspace Snort instance. this allows a level of tuning with respect to how much work the kernel does to qualify a packet based on a signature match before having Snort do the same thing. the default is to perform all specified content matches in the signature before queuing the packet to userspace because the multiple in-kernel content matches is probably less expensive than sending a packet to userspace by default. ⚙️
  • --string-match-alg <alg> — specify the string matching algorithm to use with the kernel. by default, this is 'bm' for the 'Boyer-Moore' string matching algorithm, but 'kmp' may also be specified (short for the 'Knuth–Morris–Pratt' algorithm). 🧵
  • --ipt-apply — execute the iptables script generated by fwsnort. ▶️
  • --ipt-exec — synonym for --ipt-apply. 🔁
  • --ipt-revert — revert to a version of the iptables policy without any fwsnort rules. note that this reverts to the iptables policy as it was when fwsnort was originally executed. so, it is not recommended to use this option if there is a large amount of time between when fwsnort is run to translate Snort rules vs. running it with this option. for most purposes it is better to use the --ipt-flush option below. ⏪
💀 bestie, seriously, don't sleep on that warning — --ipt-revert goes all the way back to how things were at the original run, not to some recent nice state. --ipt-flush is usually the move.
  • --ipt-flush — flush all fwsnort currently active iptables rules (flushes the fwsnort chains). 🚿
  • --ipt-list — list all fwsnort currently active iptables rules (lists the fwsnort chains). 📋
  • --ipt-drop — for every single logging rule fwsnort generates, it also drops a matching DROP rule right next to it. 💀 Heads up though: for TCP sessions, using this makes retransmissions happen, because packets that are part of already-established sessions get selectively dropped. And remember, false positives are just... a normal thing for intrusion detection systems, so running this or --ipt-reject can genuinely break stuff on your network! You have been warned. 🫶
  • --ipt-reject — same deal but spicy: every logging rule gets a matching REJECT rule. Reset packets get generated for TCP sessions via the --reject-with tcp-reset option, and ICMP port unreachable messages get generated for UDP packets via the --reject-with icmp-port-unreachable option. 💅
  • -C, --Conntrack-state <state> — set a conntrack state to stand in for the "established" state that usually tags along with the Snort "flow" keyword. By default fwsnort rolls with the conntrack state of "ESTABLISHED". In some corner cases it's actually useful to use "ESTABLISHED,RELATED" instead, so you can apply application layer inspection to stuff like ICMP port unreachable messages that are responses to real attempted communications. 🦋
  • --no-ipt-log — by default fwsnort generates an iptables script that implements a logging rule for each successfully translated snort rule. You can turn that off with --no-ipt-log, but --ipt-drop has to be specified too.
  • --no-ipt-sync — this one is deprecated, since the default behavior is already to translate as many Snort rules into iptables rules as possible. Now that fwsnort can produce iptables rules in iptables-save format, instantiating a big old set of translated Snort rules into an iptables policy is extremely fast. A new --ipt-sync option was added to reverse this behavior (not recommended, bestie). 🙈
  • --ipt-sync — go look at the iptables policy currently running on the machine and find applicable snort rules.
  • --no-ipt-test — don't test the iptables build for whether it supports the LOG and REJECT targets, or ascii and hex string matching.
  • --no-ipt-jumps — don't jump packets from the built-in iptables INPUT, OUTPUT, and FORWARD chains to the custom fwsnort chains. This one is mostly useful for making it easy to manually change where the jump rules sit in the iptables ruleset. ✨
  • --no-ipt-rule-nums — by default fwsnort puts the rule number inside the logging prefix for every rule it adds to the fwsnort chains. E.g. the logging prefix for rule 34 would look something like "[34] SID1242 ESTAB". Use this option to not include the rule number.
  • --no-ipt-comments — if the iptables "comment" match exists, then fwsnort tucks the Snort "msg", "classtype", "reference", "priority", and "rev" fields inside a comment for each iptables rule. Use this option to disable that.
  • --no-ipt-INPUT — don't jump packets from the iptables INPUT chain to the fwsnort chains.
  • --no-ipt-OUTPUT — don't jump packets from the iptables OUTPUT chain to the fwsnort chains.
  • --no-ipt-FORWARD — don't jump packets from the iptables FORWARD chain to the fwsnort chains.
  • --no-fast-pattern-ordering — stops fwsnort from trying to reorder pattern matches so the longest pattern gets processed first. The Snort fast_pattern keyword is also ignored if this option is specified.
  • -H, --Home-net <network/mask> — specify the internal network yourself instead of letting fwsnort derive it from the HOME_NET keyword in the fwsnort.conf configuration file.
  • -E, --External-net <network/mask> — specify the external network yourself instead of letting fwsnort derive it from the EXTERNAL_NET keyword in the fwsnort.conf configuration file.
  • --no-addresses — kill all the checks against the output of ifconfig for proper IP addresses. Super useful if fwsnort is running on a bridging firewall. 🌈
  • --Dump-conf — print the fwsnort configuration on STDOUT and exit.
  • --debug — run in debug mode. All parse errors that normally get written to the fwsnort logfile /var/log/fwsnort.log get written to STDOUT instead.
  • --strict — run fwsnort in "strict" mode. This stops fwsnort from translating snort rules that contain the keywords "offset", "uricontent", and "depth".
  • -U, --Ulog — force the usage of the ULOG target for all log messages instead of the default LOG target.
  • --ulog-nlgroup — specify the netlink group for ULOG rules. Rules like this only get added for Snort rules that have an action of "log", or when fwsnort is run in --Ulog mode.
  • -l, --logfile <logfile> — by default fwsnort logs all parse errors to the logfile /var/log/fwsnort.log. You can change that path by hand with the --logfile option. 🎀
  • -v, --verbose — run fwsnort in verbose mode. This makes fwsnort add the original snort rule as a comment to the fwsnort.sh script for each successfully translated rule.
  • -V, --Version — print the fwsnort version and exit.
  • -h, --help — print usage information on STDOUT and exit.

💾 FILES 💾

  • /etc/fwnort/fwsnort.conf — the fwsnort configuration file. You can change the path to this file on the command line with --config.
  • /var/lib/fwnort/fwsnort.sh — the iptables script generated by fwsnort. The path can be manually specified on the command line with the --ipt-script option.

🛠️ FWSNORT CONFIGURATION VARIABLES 🛠️

This section spills the tea on what each of the more important fwsnort configuration variables actually does and how you can tune them to meet your needs. These variables live in the fwsnort configuration file /etc/fwsnort/fwsnort.conf. ✨

🏠 HOME_NET

fwsnort uses the same HOME_NET and EXTERNAL_NET variables as defined in Snort rules, and the same semantics are supported. I.e., individual IP addresses or networks in standard dotted-quad or CIDR notation can be specified, and comma separated lists are also supported. 💅

🌍 EXTERNAL_NET

Defines the external network. See the HOME_NET variable for more information.

👑 EXAMPLES 👑

The following examples show the command line arguments you could hand to fwsnort in a few situations:

Script generation in logging mode, parse errors written to the fwsnort logfile, and iptables policy checking are enabled by default without having to specify any command line arguments:

# fwsnort

Generate ip6tables rules for attacks delivered over IPv6:

# fwsnort -6

Generate iptables rules for ddos and backdoor Snort rules only:

# fwsnort --include-type ddos,backdoor

Generate iptables rules for Snort ID's 2008475 and 2003268 (from emerging-all.rules):

fwsnort --snort-sid 2008475,2003268

Generate iptables rules for Snort ID's 1834 and 2001842 but queue them to userspace via the NFQUEUE target and restrict exclude the INPUT and OUTPUT chains:

fwsnort --snort-sid 1834,2001842 --NFQUEUE --no-ipt-INPUT --no-ipt-
OUTPUT

Instruct fwsnort to only inspect traffic that traverses the eth0 and eth1 interfaces:

# fwsnort --restrict-intf eth0,eth1

Generate iptables rules for Snort rules that appear to be allowed by the local iptables policy, and write original snort rules to the iptables script as a comment:

# fwsnort --ipt-sync --verbose

📦 DEPENDENCIES 📦

fwsnort requires that the iptables string match module be compiled into the kernel (or as a loadable kernel module) in order to be able to match snort signatures that make use of the "content" keyword. Note that the --no-opt-test option can be specified to have fwsnort generate an iptables script even if the string match module is not compiled in.

fwsnort also requires the IPTables::Parse CPAN module in order to parse iptables policies. This module is bundled with the fwsnort sources in the deps/ directory for convenience. 🫶

🩺 DIAGNOSTICS 🩺

The --debug option can be used to display on STDOUT any errors that are generated as fwsnort parses each snort rule. Normally these errors are written to the fwsnort logfile /var/log/fwsnort.log. 😭

👀 SEE ALSO 👀

psad(8), iptables(8), snort(8), nmap(1)

✍️ AUTHOR ✍️

Michael Rash <mbr@cipherdyne.org>

🫂 CONTRIBUTORS 🫂

Many people who are active in the open source community have contributed to fwsnort; see the CREDITS file in the fwsnort sources, or visit http://www.cipherdyne.org/fwsnort/docs/contributors.html to view the online list of contributors. 💖

fwsnort is based on the original snort2iptables script written by William Stearns.

🐛 BUGS 🐛

Send bug reports to mbr@cipherdyne.org. Suggestions and/or comments are always welcome as well. 🎀

📜 DISTRIBUTION 📜

fwsnort is distributed under the GNU General Public License (GPLv2), and the latest version may be downloaded from http://www.cipherdyne.org/. Snort is a registered trademark of Sourcefire, Inc.

and that's the whole page, bestie — the version info lives on the Linux line dated Jan, 2011 with FWSNORT(8) as the manual name, so go forth, translate those rules, and slay. periodt. 💅✨

📦 where this page comes from