Good day, I have installed suricata behind the proxy server. I add the client source IP address to the proxy using the xff header. I also set the eve log on the suricata using x-forwarded-for and everything is fine in the eve log. However, I have a problem if I write a rule with a specific IP addre…

Unfortunately @syoc is correct. The xff functionality currently only applies to output. Using xff (and similar headers) in the detection engine would be quite a bit of work. Just overwriting the data in the packet would be tricky and risky too. Headers can be easily faked, and they might be used to…

Suricata behind proxy server

Help

Knight (ALEX ALEX) May 23, 2023, 1:46pm 8

Hello Guys,
Well I’m running into the same problem these days and my Suricata sensor is installed behind a proxy. So how to make it alert with the real IP addresses but not the proxy IP.
thanks

Suricata in AF_PACKET mode creates an inifinite loop

Topic		Replies	Views
XFF and Syslog Output Help	7	1013	August 29, 2021
Create customize suricata using bash script Help	4	555	September 30, 2021
Suricata not rejecting traffic when nothing is reading named pipe for eve logs Help	2	608	June 19, 2020
Rules and log files	1	316	November 28, 2023
After installation, Suricata writes only statistics to eve Help	5	505	December 2, 2021

Suricata behind proxy server

Related Topics