# \[SOLVED\] NFQUEUE bypassing UFW rules **URL:** \ **Category:** Help\ **Created:** [November 27, 2024, 4:10pm UTC](https://forum.suricata.io/t/solved-nfqueue-bypassing-ufw-rules/5072 "2024-11-27T16:10:35Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![luzyork](https://avatars.discourse-cdn.com/v4/letter/l/97f17d/32.png) [@luzyork](https://forum.suricata.io/u/luzyork)\ **Post date:** [November 27, 2024, 4:10pm UTC](https://forum.suricata.io/t/solved-nfqueue-bypassing-ufw-rules/5072/1 "2024-11-27T16:10:35Z")
On a Debian 12 system, we successfully set up traffic to be routed through Suricata NFQUEUE. It all works. Traffic is being blocked and logged as we want it to, all according to suricata.rules, etc. HOWEVER it seems that all traffic now completely circumvents the rest of our rules in UFW, and now all ports are open on our host(!). Everything not triggering a DROP in suricata.rules gets routed through. (For example, if we run a test web-server on a random port, traffic gets through, although UFW polity is set to INPUT DROP and has very few ALLOW rules.) With `iptables -vL` it is clear that traffic never reaches the UFW rule-sets in the firewall, all counters are zero. **Is there a way to pipe traffic back to the rest of the rule-sets in UFW firewall / iptables after being inspected by Suricata?** I guess it is as simple as adding a final -j rule to NFQUEUE or IPTABLES somewhere somehow, but I am not familiar enough with the syntax to see how to fix it. All help very much appreciated. * * * Section added to `/etc/ufw/before.rules`: ```auto ### SURICATA ### -I INPUT 1 -p tcp --dport 12345 -j NFQUEUE --queue-bypass -I OUTPUT 1 -p tcp --sport 12345 -j NFQUEUE --queue-bypass -I FORWARD -j NFQUEUE -I INPUT 2 -j NFQUEUE -I OUTPUT 2 -j NFQUEUE ### END SURICATA ### ``` Output of `iptables -v -n -L --line-numbers`: ```auto Chain INPUT (policy DROP 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 9028 548K NFQUEUE 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:12345 NFQUEUE num 0 bypass 2 123K 13M NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 3 1107K 1015M NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 4 0 0 NFQUEUE 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:12345 NFQUEUE num 0 bypass 5 441 61938 NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 6 0 0 NFQUEUE 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:12345 NFQUEUE num 0 bypass 7 369 57670 NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 8 0 0 NFQUEUE 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:12345 NFQUEUE num 0 bypass 9 447K 196M NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 10 0 0 NFQUEUE 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:12345 NFQUEUE num 0 bypass 11 0 0 ufw-before-logging-input 0 -- * * 0.0.0.0/0 0.0.0.0/0 12 0 0 ufw-before-input 0 -- * * 0.0.0.0/0 0.0.0.0/0 13 0 0 ufw-after-input 0 -- * * 0.0.0.0/0 0.0.0.0/0 14 0 0 ufw-after-logging-input 0 -- * * 0.0.0.0/0 0.0.0.0/0 15 0 0 ufw-reject-input 0 -- * * 0.0.0.0/0 0.0.0.0/0 16 0 0 ufw-track-input 0 -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy DROP 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 0 0 NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 2 48715 68M NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 3 0 0 NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 4 0 0 NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 5 55366 79M NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 6 0 0 ufw-before-logging-forward 0 -- * * 0.0.0.0/0 0.0.0.0/0 7 0 0 ufw-before-forward 0 -- * * 0.0.0.0/0 0.0.0.0/0 8 0 0 ufw-after-forward 0 -- * * 0.0.0.0/0 0.0.0.0/0 9 0 0 ufw-after-logging-forward 0 -- * * 0.0.0.0/0 0.0.0.0/0 10 0 0 ufw-reject-forward 0 -- * * 0.0.0.0/0 0.0.0.0/0 11 0 0 ufw-track-forward 0 -- * * 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 13851 5725K NFQUEUE 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:12345 NFQUEUE num 0 bypass 2 111K 8707K NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 3 920K 193M NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 4 0 0 NFQUEUE 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:12345 NFQUEUE num 0 bypass 5 267 110K NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 6 0 0 NFQUEUE 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:12345 NFQUEUE num 0 bypass 7 230 135K NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 8 0 0 NFQUEUE 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:12345 NFQUEUE num 0 bypass 9 367K 117M NFQUEUE 0 -- * * 0.0.0.0/0 0.0.0.0/0 NFQUEUE num 0 10 0 0 NFQUEUE 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:12345 NFQUEUE num 0 bypass 11 0 0 ufw-before-logging-output 0 -- * * 0.0.0.0/0 0.0.0.0/0 12 0 0 ufw-before-output 0 -- * * 0.0.0.0/0 0.0.0.0/0 13 0 0 ufw-after-output 0 -- * * 0.0.0.0/0 0.0.0.0/0 14 0 0 ufw-after-logging-output 0 -- * * 0.0.0.0/0 0.0.0.0/0 15 0 0 ufw-reject-output 0 -- * * 0.0.0.0/0 0.0.0.0/0 16 0 0 ufw-track-output 0 -- * * 0.0.0.0/0 0.0.0.0/0 ``` (…) rest of UFW rules below, not pasted here. ---
**Author:** ![luzyork](https://avatars.discourse-cdn.com/v4/letter/l/97f17d/32.png) [@luzyork](https://forum.suricata.io/u/luzyork)\ **Post date:** [November 27, 2024, 4:57pm UTC](https://forum.suricata.io/t/solved-nfqueue-bypassing-ufw-rules/5072/2 "2024-11-27T16:57:30Z")
(same problem mentioned here, but without any apparent solution: [Iptables + NFQUEUE](https://forum.suricata.io/t/iptables-nfqueue/1385)) ---
**Author:** ![luzyork](https://avatars.discourse-cdn.com/v4/letter/l/97f17d/32.png) [@luzyork](https://forum.suricata.io/u/luzyork)\ **Post date:** [November 28, 2024, 1:50am UTC](https://forum.suricata.io/t/solved-nfqueue-bypassing-ufw-rules/5072/3 "2024-11-28T01:50:42Z")
Managed to solve this by adjusting nfq-section in `suricata.yaml`, and adjusting UFW `before.rules`: In `/etc/suricata/suricata.yaml` change to ```auto nfq: mode: repeat repeat-mark: 1 repeat-mask: 1 ``` in `/etc/ufw/before.rules` insert section: ```auto ### SURICATA ### -I INPUT 1 -p tcp --dport 12345 -j NFQUEUE --queue-bypass -I OUTPUT 1 -p tcp --sport 12345 -j NFQUEUE --queue-bypass -I INPUT 2 -m mark ! --mark 1/1 -j NFQUEUE -I FORWARD 1 -m mark ! --mark 1/1 -j NFQUEUE -I OUTPUT 2 -m mark ! --mark 1/1 -j NFQUEUE ### END SURICATA ### ``` (where 12345 is the ssh-port you want to bypass, so you keep access in case suricata goes down. If you do not need this, you can skip the first two lines) Restart UFW and Suricata: ```auto systemctl restart ufw.service systemctl restart suricata.service ``` Explanation Suricata repeat- and route-mode here: > **[Suricatayaml - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml#NFQ)** > > Redmine