FWSNORT(8)

NAME
fwsnort - Firewall Snort

SYNOPSIS
fwsnort [-t snort-rule-type ] [-l logfile ] [-v] [-V] [-h] [-t] [-u] [-c config-file ] [--snort-sid sid ] [--ipt-script script ] [--ipt-apply] [--ipt-drop] [--ipt-reject] [--no-ipt-sync] [--no-ipt-log] [--no-ipt-test] [--no-ipt-test] [--internal-net] [--dmz-net] [--dump-conf] [--debug] [--strict]

DESCRIPTION
fwsnort translates snort rules into equivalent iptables rules and generates a bourne shell script that implements the resulting iptables ruleset. This ruleset allows network traffic that exhibits snort signatures to be logged and/or dropped by iptables directly without putting any interface into promiscuous mode or queuing packets from kernel to user space. In addition, fwsnort (optionally) uses the IPTables::Parse module to parse the iptables ruleset on the machine to determine which snort rules are applicable to the specific iptables policy. After all, if iptables is blocking all inbound http traffic from external addresses, it is probably not of much use to try detecting inbound attacks against against tcp/80. By default fwsnort generates iptables rules that log snort sid's with --log-prefix to klogd where the messages can be analyzed with a log watcher such as logwatch or psad. fwsnort relies on the iptables string match module to match snort content fields in the application portion of ip traffic. Since snort rules can contain hex data in content fields, fwsnort implements a patch against iptables-1.2.7a which adds a "--hex-string" option which will accept content fields such as "|0d0a5b52504c5d3030320d0a|". fwsnort is able to translate approximately 70% of all snort signatures into equivalent iptables rules. For more information about the translation strategy as well as advantages/disadvantages of the method used by fwsnort to obtain intrusion detection data, see the README included with the fwsnort sources or browse to: http://www.cipherdyne.org/fwsnort/.

OPTIONS

-c, --config <configuration file>
    By default fwsnort makes use of the configuration file /etc/fwsnort/fwsnort.conf for almost all configuration parameters. fwsnort can be made to override this path by specifying a different file on the command line with the --config option.
-t, --type  <rules type>
    Restrict to processing snort rules of <rules type>. Example rule types would include "ddos", "backdoor", and "web-attacks".
-u, --update-rules
    Download the latest Bleeding Snort rules from http://www.bleedingsnort.com/. This will overwrite the bleeding-all.rules file in the /etc/fwsnort/snort_rules/ directory. Note that the automatic downloading of Snort rules from http://www.snort.org/ as of March, 2005 is only offered as a pay service.
--snort-sid <sid>
    Generate an iptables ruleset for a single snort rule specified by <sid>.
--ipt-script <script file>
    Specify the path to the iptables script generated by fwsnort. The default location is /etc/fwsnort/fwsnort.sh.
--ipt-apply
    Execute the iptables script generated by fwsnort.
--ipt-drop
    For each logging rule generated by fwsnort, add a corresponding DROP rule. Note that for TCP sessions using this option will cause retranmissions as packets that are part of established sessions selectively dropped. Remember that false positives are common occurrences for intrusion detection systems, and so using this or the --ipt-reject option may break things on your network! You have been warned.
--ipt-reject
    For each logging rule generated by fwsnort, add a corresponding REJECT rule. Reset packets will be generated for TCP sessions through the use of the "--reject-with tcp-reset" option, and icmp port unreachable messages will be generated for UDP packets through the use of the "--reject-with icmp-port-unreachable" option.
--no-ipt-log
    By default fwsnort generates an iptables script that implements a logging rule for each successfully translated snort rule. This can be disabled with the --no-ipt-log option, but --ipt-drop must also be specified.
--no-ipt-sync
    Do not consult the iptables policy currently running on the machine for applicable snort rules. Unless limited with the --type or --snort-sid options this can result in a fwsnort.sh script that contains several thousand iptables rules.
--no-ipt-test
    Do not test the iptables build for existence of support for the LOG and REJECT targets, and ascii and hex string matching.
--no-ipt-jumps
    Do not jump packets from the built-in iptables INPUT and FORWARD chains to the custom fwsnort chains. This options is mostly useful to make it easy to manually alter the placement of the jump rules in the iptables ruleset.
-i, --internal-net <network/mask>
    Specify the internal network instead of having fwsnort parse the output of ifconfig. This is useful if the internal interface does not have an ip address assigned (such as when the Linux system is acting as a bridge). Note there is no "--external-net" option since iptables rules are built relative to the internal network. Both CIDR and standard notations (e.g. "192.168.10.0/24" and "192.168.10.0/255.255.255.0") for the <network/mask> combination are supported.
-d, --dmz-net <network/mask>
    Specify the dmz network instead of reading this information out of the output of ifconfig. Similarly to the --internal-net option, both CIDR and standard notations (e.g. "192.168.10.0/24" and "192.168.10.0/255.255.255.0") for the <network/mask> combination are supported.
--dump-conf
    Print the fwsnort configuration on STDOUT and exit.
--debug
    Run in debug mode. This will cause all parse errors which are normally written to the fwsnort logfile /var/log/fwsnort.log to be written to STDOUT instead.
--strict
    Run fwsnort in "strict" mode. This will prevent fwsnort from translating snort rules that contain the keywords "offset", "uricontent", and "depth".
-l, --logfile <logfile>
    By default fwsnort logs all parse errors to the logfile /var/log/fwsnort.log. This path can be manually changed with the --logfile option.
-v, --verbose
    Run fwsnort in verbose mode. This will cause fwsnort to add the original snort rule as a comment to the fwsnort.sh script for each successfully translated rule.
-V, --Version
    Print the fwsnort version and exit.
-h, --help
    Print usage information on STDOUT and exit.

FILES
/etc/fwnort/fwsnort.conf
    The fwsnort configuration file. The path to this file can be changed on the command line with --config.
/etc/fwnort/fwsnort.sh
    The iptables script generated by fwsnort. The path can be manually specified on the command line with the --ipt-script option.

FWSNORT CONFIGURATION VARIABLES
This section describes what each of the more important fwsnort configuration variables do and how they can be tuned to meet your needs. These variables are located in the fwsnort configuration file /etc/fwsnort/fwsnort.conf

EXTERNAL_INTF
    fwsnort can handle from one to three interfaces on the iptables firewall; one external interface, one internal interface, and one dmz interface. EXTERNAL_INTF specifies the external interface and must match the name of one interface on the Linux system as reported under ifconfig, e.g. "eth0". Both the external and interfaces must be defined, but if fwsnort is deployed on a single-interface host, then define the external and internal interfaces to be the same.

INTERNAL_INTF
    Defines the internal interface, e.g. "eth1". (May be the same as the external interface if the host has only one interface).

DMZ_INTF
    Defines an (optional) dmz interface, e.g. "eth2".

EXAMPLES
The following examples illustrate the command line arguments that could be supplied to fwsnort in a few situations: Script generation in logging mode, parse errors written to the fwsnort logfile, and iptables policy checking are enabled by default without having to specify any command line arguments: # fwsnort Generate iptables rules for ddos snort rules only: # fwsnort --type ddos Generate iptables rules for all snort rules, and write original snort rule to the iptables script as a comment: # fwsnort --no-ipt-sync --verbose

DEPENDENCIES
fwsnort requires that the iptables string match module be compiled into the kernel (or as a loadable kernel module) in order to be able to match snort signatures that make use of the "content" keyword. Note that the --no-opt-test option can be specified to have fwsnort generate an iptables script even if the string match module is not compiled in. fwsnort also requires the IPTables::Parse module in order to parse iptables policies.

DIAGNOSTICS
The --debug option can be used to display on STDOUT any errors that are generated as fwsnort parses each snort rule. Normally these errors are written to the fwsnort logfile /var/log/fwsnort.log

SEE ALSO
psad(8), iptables(8), snort(8), nmap(1)

AUTHOR
Michael Rash <mbr@cipherdyne.org>

CREDITS
fwsnort is based on the original snort2iptables script written by William Stearns.

BUGS
Send bug reports to mbr@cipherdyne.org. Suggestions and/or comments are always welcome as well.

DISTRIBUTION
fwsnort is distributed under the GNU General Public License (GPL), and the latest version may be downloaded from http://www.cipherdyne.org