https://u-random.dev/tags/difficile/Recent content in Difficile on u-randomHugo -- gohugo.ioit-itFri, 29 May 2026 00:00:00 +0000https://u-random.dev/blog/suricata-ips-nfqueue/Fri, 29 May 2026 00:00:00 +0000https://u-random.dev/blog/suricata-ips-nfqueue/<p> </p> <div style="border-left:3px solid #6366f1;background:rgba(99,102,241,0.06);padding:12px 16px;border-radius:0 6px 6px 0;margin:1.5rem 0;"> <div style="font-size:0.7rem;font-weight:800;letter-spacing:0.1em;color:#6366f1;text-transform:uppercase;margin-bottom:6px;">TL;DR</div> <div style="font-size:0.95rem;line-height:1.6;"><ul> <li><strong>IDS (af-packet):</strong> copia del traffico → Suricata vede tutto, non può bloccare niente → <code>[**]</code> in fast.log</li> <li><strong>IPS (nfqueue):</strong> traffico originale trattenuto → il kernel aspetta il verdetto → <code>[Drop]</code> in fast.log</li> <li><code>iptables -I INPUT -j NFQUEUE --queue-num 0</code> è la singola regola che trasforma il sistema</li> <li><code>fail-open: no</code> = fail-closed: se Suricata muore, tutto il traffico viene droppato</li> <li>Il Docker bridge (<code>br-XXXX</code>) bypassa NFQUEUE - la SYN-ACK di ritorno viene bloccata e Wazuh si disconnette</li> <li>La persistenza al reboot richiede un systemd service dedicato (non <code>iptables-persistent</code>, che rimuove UFW)</li> </ul> </div> </div> <details style="border-left:3px solid #10b981;background:rgba(16,185,129,0.06);border-radius:0 6px 6px 0;margin:1.5rem 0;"> <summary style="padding:10px 16px;font-size:0.7rem;font-weight:800;letter-spacing:0.1em;color:#10b981;text-transform:uppercase;cursor:pointer;list-style:none;display:flex;align-items:center;gap:8px;"> <span style="font-size:0.65rem;transition:transform 0.2s;">▶</span> $ history </summary> <div style="padding:4px 16px 12px;font-size:0.92rem;line-height:1.7;font-family:'JetBrains Mono','Fira Code',monospace;"><ul> <li>suricata -T -c /etc/suricata/suricata.yaml -v</li> <li>suricata-update</li> <li><a href="https://u-random.dev/concetti/iptables/" >iptables</a> -I INPUT 1 -j NFQUEUE --queue-num 0</li> <li><a href="https://u-random.dev/concetti/iptables/" >iptables</a> -L INPUT -n -v --line-numbers</li> <li><a href="https://u-random.dev/comandi/nmap/" >nmap</a> --min-rate 1000 -p 1-1000 192.168.64.3</li> <li>hping3 -S --flood 192.168.64.3</li> <li>cat /proc/net/tcp</li> </ul> </div> </details> <hr> <p>Voglio vedere cosa succede quando Suricata non si limita a guardare il traffico, ma lo blocca davvero.</p>