Suricata iptables and nft errors when all is setting up correctly

Please include the following information with your help request:

  • 6
  • Debian
  • Apt package

Problem: I’m setting up the suricata package in ips mode using nfq. Additional packages have been downloaded, suricata is configured for nfq with documentation from the official website, everything is updated, but the suricata.service service constantly failed with the reason exit.code if not the default configuration (interfaces are good).

If I try to enable suricata manually, I get the error nfq for af_inet failed. The error occurs due to an incorrectly configured nfqueue. I’m trying to configure it again using iptables -I forward -j NFQUEUE error nfqueue revision 0 is not supported, missing kernel module? I realized that I needed to configure nftables, created a table, created a chain, entered the rules and got the error file not found… There is nothing in logs, only exit-code error. af_packet ips does not suit me. Thank you

Please include exact commands and error outputs.

Suricata -c /etc/suricata/suricata.yaml - nfq_unbind_pf() for af_inet failed

Iptables -i FORWARD -j NFQUEUE - nfqueue (no such file or directory). Missing kernel module?

nft add rule filter IPSNFQ queue - Could not process rule: no such file or directory.

Please read the error messages carefully, you’re missing the related kernel module to use NFQUEUE.