# \[SOLVED\] NFQUEUE bypassing UFW rules

**URL:** <https://forum.suricata.io/t/solved-nfqueue-bypassing-ufw-rules/5072>\
**Category:** Help\
**Created:** [November 27, 2024, 4:10pm UTC](https://forum.suricata.io/t/solved-nfqueue-bypassing-ufw-rules/5072 "2024-11-27T16:10:35Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![luzyork](https://avatars.discourse-cdn.com/v4/letter/l/97f17d/32.png) [@luzyork](https://forum.suricata.io/u/luzyork)\
**Post date:** [November 28, 2024, 1:50am UTC](https://forum.suricata.io/t/solved-nfqueue-bypassing-ufw-rules/5072/3 "2024-11-28T01:50:42Z")

</div>

Managed to solve this by adjusting nfq-section in `suricata.yaml`, and adjusting UFW `before.rules`:

In `/etc/suricata/suricata.yaml` change to

```auto
nfq:
  mode: repeat
  repeat-mark: 1
  repeat-mask: 1

```

in `/etc/ufw/before.rules` insert section:

```auto
### SURICATA ###
-I INPUT 1 -p tcp --dport 12345 -j NFQUEUE --queue-bypass
-I OUTPUT 1 -p tcp --sport 12345 -j NFQUEUE --queue-bypass
-I INPUT 2 -m mark ! --mark 1/1 -j NFQUEUE
-I FORWARD 1 -m mark ! --mark 1/1 -j NFQUEUE
-I OUTPUT 2 -m mark ! --mark 1/1 -j NFQUEUE
### END SURICATA ###

```

(where 12345 is the ssh-port you want to bypass, so you keep access in case suricata goes down. If you do not need this, you can skip the first two lines)

Restart UFW and Suricata:

```auto
systemctl restart ufw.service
systemctl restart suricata.service

```

Explanation Suricata repeat- and route-mode here:

> **[Suricatayaml - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml#NFQ)**
>
> Redmine

---

_[View the full topic](https://forum.suricata.io/t/solved-nfqueue-bypassing-ufw-rules/5072)._