Suricata iptables and nft errors when all is setting up correctly

Help
1

Please include the following information with your help request:

  • 6
  • Debian
  • Apt package

Hello,
Problem: I’m setting up the suricata package in ips mode using nfq. Additional packages have been downloaded, suricata is configured for nfq with documentation from the official website, everything is updated, but the suricata.service service constantly failed with the reason exit.code if not the default configuration (interfaces are good).

If I try to enable suricata manually, I get the error nfq for af_inet failed. The error occurs due to an incorrectly configured nfqueue. I’m trying to configure it again using iptables -I forward -j NFQUEUE error nfqueue revision 0 is not supported, missing kernel module? I realized that I needed to configure nftables, created a table, created a chain, entered the rules and got the error file not found… There is nothing in logs, only exit-code error. af_packet ips does not suit me. Thank you

2

Please include exact commands and error outputs.

3

Suricata -c /etc/suricata/suricata.yaml - nfq_unbind_pf() for af_inet failed

Iptables -i FORWARD -j NFQUEUE - nfqueue (no such file or directory). Missing kernel module?

20231106_192918
20231106_1929181920×1080 155 KB

20231106_193800
20231106_1938001920×1080 223 KB

20231106_194004
20231106_1940041920×1080 71.2 KB

20231106_193809
20231106_1938094000×2250 572 KB

nft add rule filter IPSNFQ queue - Could not process rule: no such file or directory.

4

Please read the error messages carefully, you’re missing the related kernel module to use NFQUEUE.