SSH to/from suricata servers cannot work well

Help
,
1

Hi

I want to use suricata as IPS. However, SSH to/from suricata servers cannot work well.
For example, SSH connection to suricata server from other server disconnect after a short time.
Furthermore, SSH connection from suricata server to other server connot be established. (Maybe reply of SSH connection to suricata server from other server is droped.)

Suricata works in IPS mode such as following command. (Actually suricata runs by systemctl.)
$ suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid -q 0 -D -vvv
(suricata.yaml is left as default. In addition, I tried to run suricata with no rules.)

And I set a following iptables rule in suricata server for receiving packet by suricata.
$ sudo iptables -I INPUT -j NFQUEUE
$ sudo iptables -vL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
412 49935 NFQUEUE all – any any anywhere anywhere NFQUEUE num 0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Do you know how use SSH to/from suricata server with no disconnection?

I observed these issues in 2 patterns.
[Pattern 1]
Suricata version: 7.0.2 (latest in Ubuntu apt)
OS: Ubuntu 22.04.3 LTS
How I installed suricata: sudo add-apt-repository ppa:oisf/suricata-stable && sudo apt install suricata

[Pattern 2]
Suricata version: 8.0.0-dev (3cb7112aa 2024-01-19)
OS: Ubuntu 22.04.3 LTS
How I installed suricata: git clone source code and build

Thank you.

2

This iptables ruleset only sends one side of the traffic to Suricata (through INPUT table), but not the other side. Add an NFQUEUE rule to your OUTPUT table as well.

3

Thank you for your comment.

I’d like to allow all output packets, so Suricata wouldn’t need to inspect them.
I thought that any NFQUEUE rules in the OUTPUT table would be unnecessary.
However, considering Suricata’s features, do we need to set NFQUEUE rules in both the INPUT and OUTPUT tables, even when Suricata only needs to inspect packets in one direction packets of TCP connections?

4

Yes, Suricata needs to see both sides of the traffic.

5

I understood. Thank you very much.