I am developing a Suricata management system and using Redis for eve.json output. Everything works perfectly in IDS mode. However, when switching to IPS mode, a problem arises: Suricata hangs. It seems like writing to Redis is blocking the traffic. Commands for iptables
iptables -I INPUT -i lo -j ACCEPT
iptables -I OUTPUT -o lo -j ACCEPT
do not improve the situation. When using regular eve.json output, everything seems to work fine. What could be the issue?
Can you check what the connection to redis looks like in conntrack?
It seems I solved this problem.
I used wrong iptables rules:
iptables -I INPUT -i lo -j ACCEPT
iptables -I OUTPUT -o lo -j ACCEPT
iptables -I INPUT -j NFQUEUE --queue-bypass
iptables -I OUTPUT -j NFQUEUE --queue-bypass
I changed them to
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -j NFQUEUE --queue-bypass
iptables -A OUTPUT -j NFQUEUE --queue-bypass
and all work now.
Thank you for wanting to help.