FWSNORT(8)

NAME
fwsnort - Firewall Snort

SYNOPSIS
fwsnort [-l logfile ] [-v] [-V] [-h] [-t] [-U] [-c config-file ] [--snort-sid sid ] [--exclude-sid sid ] [--include-type type ] [--exclude-type type ] [--ipt-script script ] [--snort-conf file ] [--snort-rdir dir ] [--ipt-apply] [--ipt-drop] [--ipt-reject] [--no-ipt-sync] [--no-ipt-log] [--ipt-flush] [--ipt-list] [--no-ipt-test] [--no-ipt-jumps] [--no-ipt-conntrack] [--no-ipt-INPUT] [--no-ipt-OUTPUT] [--no-ipt-FORWARD] [--no-exclude-lo] [--no-addresses] [--Home-net] [--Dump-conf] [--debug] [--strict] [--ulog-nlgroup groupnum ] [--update-rules]

DESCRIPTION
fwsnort translates Snort rules into equivalent Netfilter rules and generates a Bourne shell script that implements the resulting iptables commands. This ruleset allows network traffic that exhibits Snort signatures to be logged and/or dropped by Netfilter directly without putting any interface into promiscuous mode or queuing packets from kernel to user space. In addition, fwsnort (optionally) uses the IPTables::Parse module to parse the Netfilter ruleset on the machine to determine which Snort rules are applicable to the specific Netfilter policy. After all, if Netfilter is blocking all inbound http traffic from external addresses, it is probably not of much use to try detecting inbound attacks against against tcp/80. By default fwsnort generates Netfilter rules that log Snort sid's with --log-prefix to klogd where the messages can be analyzed with a log watcher such as logwatch or psad (see http://www.cipherdyne.org/psad). fwsnort relies on the Netfilter string match module to match Snort content fields in the application portion of ip traffic. Since Snort rules can contain hex data in content fields, fwsnort implements a patch against iptables-1.2.7a which adds a "--hex-string" option which will accept content fields such as "|0d0a5b52504c5d3030320d0a|". fwsnort is able to translate approximately 54% of all rules from the Snort-2.3 IDS into equivalent Netfilter rules. For more information about the translation strategy as well as advantages/disadvantages of the method used by fwsnort to obtain intrusion detection data, see the README included with the fwsnort sources or browse to: http://www.cipherdyne.org/fwsnort/.

OPTIONS

-c, --config <configuration file>
    By default fwsnort makes use of the configuration file /etc/fwsnort/fwsnort.conf for almost all configuration parameters. fwsnort can be made to override this path by specifying a different file on the command line with the --config option.
--include-type  <rules type>
    Restrict to processing snort rules of <rules type>. Example rule types would include "ddos", "backdoor", and "web-attacks". This option also supports a comma-separated list of types, e.g. "ddos,backdoor".
--exclude-type  <rules type>
    Exclude all Snort rules from of type <rules type> from the translation process. For example, if you don't want any rules from the file bleeding-all.rules to be translated, then use "bleeding-all" as the argument to this option. A comma-separated list of types to exclude can be specified.
--update-rules
    Download the latest Bleeding Snort rules from http://www.bleedingsnort.com/. This will overwrite the bleeding-all.rules file in the /etc/fwsnort/snort_rules/ directory. Note that the automatic downloading of Snort rules from http://www.snort.org/ as of March, 2005 is only offered as a pay service.
--snort-sid <sid>
    Generate an iptables ruleset for a single snort rule specified by <sid>. A comma-separated list of sids can be specified, e.g. "2001842,1834".
--exclude-sid <sid>
    Provide a list of Snort ID's to be excluded from the translation process.
--ipt-script <script file>
    Specify the path to the iptables script generated by fwsnort. The default location is /etc/fwsnort/fwsnort.sh.
--ipt-apply
    Execute the iptables script generated by fwsnort.
--ipt-flush
    Flush all fwsnort currently active Netfilter rules (flushes the fwsnort chains).
--ipt-list
    List all fwsnort currently active Netfilter rules (lists the fwsnort chains).
--ipt-drop
    For each logging rule generated by fwsnort add a corresponding DROP rule. Note that for TCP sessions using this option will cause retranmissions as packets that are part of established sessions selectively dropped. Remember that false positives are common occurrences for intrusion detection systems, and so using this or the --ipt-reject option may break things on your network! You have been warned.
--ipt-reject
    For each logging rule generated by fwsnort add a corresponding REJECT rule. Reset packets will be generated for TCP sessions through the use of the "--reject-with tcp-reset" option, and icmp port unreachable messages will be generated for UDP packets through the use of the "--reject-with icmp-port-unreachable" option.
--no-ipt-log
    By default fwsnort generates an iptables script that implements a logging rule for each successfully translated snort rule. This can be disabled with the --no-ipt-log option, but --ipt-drop must also be specified.
--no-ipt-sync
    Do not consult the iptables policy currently running on the machine for applicable snort rules. Unless limited with the --include-type or --snort-sid options this can result in a fwsnort.sh script that contains several thousand iptables rules.
--no-ipt-test
    Do not test the iptables build for existence of support for the LOG and REJECT targets, and ascii and hex string matching.
--no-ipt-jumps
    Do not jump packets from the built-in Netfilter INPUT, OUTPUT, and FORWARD chains to the custom fwsnort chains. This options is mostly useful to make it easy to manually alter the placement of the jump rules in the iptables ruleset.
--no-ipt-INPUT
    Do not jump packets from the Netfilter INPUT chain to the fwsnort chains.
--no-ipt-OUTPUT
    Do not jump packets from the Netfilter OUTPUT chain to the fwsnort chains.
--no-ipt-FORWARD
    Do not jump packets from the Netfilter FORWARD chain to the fwsnort chains.
-H, --Home-net <network/mask>
    Specify the internal network instead of having fwsnort derive it from the HOME_NET keyword in the fwsnort.conf configuration file.
-E, --External-net <network/mask>
    Specify the external network instead of having fwsnort derive it from the EXTERNAL_NET keyword in the fwsnort.conf configuration file.
--no-addresses
    Disable all checks against the output of ifconfig for proper IP addresses. This is useful if fwsnort is running on a bridging firewall.
--Dump-conf
    Print the fwsnort configuration on STDOUT and exit.
--debug
    Run in debug mode. This will cause all parse errors which are normally written to the fwsnort logfile /var/log/fwsnort.log to be written to STDOUT instead.
--strict
    Run fwsnort in "strict" mode. This will prevent fwsnort from translating snort rules that contain the keywords "offset", "uricontent", and "depth".
-U, --Ulog
    Force the usage of the ULOG target for all log messages instead of the default LOG target.
--ulog-nlgroup
    Specify the netlink group for ULOG rules. Such rules are only added for Snort rules that have an action of "log", or when fwsnort is run in --Ulog mode.
-l, --logfile <logfile>
    By default fwsnort logs all parse errors to the logfile /var/log/fwsnort.log. This path can be manually changed with the --logfile option.
-v, --verbose
    Run fwsnort in verbose mode. This will cause fwsnort to add the original snort rule as a comment to the fwsnort.sh script for each successfully translated rule.
-V, --Version
    Print the fwsnort version and exit.
-h, --help
    Print usage information on STDOUT and exit.

FILES
/etc/fwnort/fwsnort.conf
    The fwsnort configuration file. The path to this file can be changed on the command line with --config.
/etc/fwnort/fwsnort.sh
    The iptables script generated by fwsnort. The path can be manually specified on the command line with the --ipt-script option.

FWSNORT CONFIGURATION VARIABLES
This section describes what each of the more important fwsnort configuration variables do and how they can be tuned to meet your needs. These variables are located in the fwsnort configuration file /etc/fwsnort/fwsnort.conf

HOME_NET
    fwsnort uses the same HOME_NET and EXTERNAL_NET variables as defined in Snort rules, and the same symmatics are supported. I.e., individual IP addresses or networks in standard dotted-quad or CIDR notation can be specified, and comma separated lists are also supported.

EXTERNAL_NET
    Defines the external network. See the HOME_NET variable for more information.

EXAMPLES
The following examples illustrate the command line arguments that could be supplied to fwsnort in a few situations: Script generation in logging mode, parse errors written to the fwsnort logfile, and iptables policy checking are enabled by default without having to specify any command line arguments: # fwsnort Generate Netfilter rules for ddos and backdoor Snort rules only: # fwsnort --include-type ddos,backdoor Generate Netfilter rules for Snort ID's 1834 and 2001842 (from bleeding-all.rules): fwsnort --snort-sid 1834,2001842 Instruct fwsnort to only inspect traffic that traverses the eth0 and eth1 interfaces: # fwsnort --restrict-intf eth0,eth1 Generate iptables rules for all Snort rules, and write original snort rule to the iptables script as a comment: # fwsnort --no-ipt-sync --verbose

DEPENDENCIES
fwsnort requires that the iptables string match module be compiled into the kernel (or as a loadable kernel module) in order to be able to match snort signatures that make use of the "content" keyword. Note that the --no-opt-test option can be specified to have fwsnort generate an iptables script even if the string match module is not compiled in. fwsnort also requires the IPTables::Parse module in order to parse iptables policies.

DIAGNOSTICS
The --debug option can be used to display on STDOUT any errors that are generated as fwsnort parses each snort rule. Normally these errors are written to the fwsnort logfile /var/log/fwsnort.log

SEE ALSO
psad(8), iptables(8), snort(8), nmap(1)

AUTHOR
Michael Rash <mbr@cipherdyne.org>

CREDITS
fwsnort is based on the original snort2iptables script written by William Stearns.

BUGS
Send bug reports to mbr@cipherdyne.org. Suggestions and/or comments are always welcome as well.

DISTRIBUTION
fwsnort is distributed under the GNU General Public License (GPL), and the latest version may be downloaded from http://www.cipherdyne.org