Let's see if I can answer myself. I modified my rules file like this:
[...] NFQUEUE(0:5,bypass) dmz,evpn,ivpn,hvpn,ovpn,vpn1,vpn2:!+CORP_IPS_BL,+CORP_POL_BL,+CORP_GLOBAL_WL lan,fw udp 137,138,139 - - - - !10 NFQUEUE(0:5,bypass) lan,fw dmz,evpn,ivpn,hvpn,ovpn,vpn1,vpn2:!+CORP_IPS_BL,+CORP_POL_BL,+CORP_GLOBAL_WL udp - 137,138,139 - - - !10 NFQUEUE(0:5,bypass) dmz,evpn,ivpn,hvpn,ovpn,vpn1,vpn2:!+CORP_IPS_BL,+CORP_POL_BL,+CORP_GLOBAL_WL lan,fw icmp - - - - - !10 NFQUEUE(0:5,bypass) lan,fw dmz,evpn,ivpn,hvpn,ovpn,vpn1,vpn2:!+CORP_IPS_BL,+CORP_POL_BL,+CORP_GLOBAL_WL icmp - - - - - !10 NFQUEUE(0:5,bypass) dmz,evpn,ivpn,hvpn,ovpn,vpn1,vpn2:!+CORP_IPS_BL,+CORP_POL_BL,+CORP_GLOBAL_WL lan,fw tcp 21,25,80,443,3389,12795 - - - - !10 NFQUEUE(0:5,bypass) lan,fw dmz,evpn,ivpn,hvpn,ovpn,vpn1,vpn2:!+CORP_IPS_BL,+CORP_POL_BL,+CORP_GLOBAL_WL tcp - 21,25,80,443,3389,12795 - - - !10 #DROP:info dmz:192.168.212.64 lan ACCEPT dmz lan:10.215.144.66 tcp 80 [...] I then set up Suricata with: nfq: mode: repeat repeat-mark: 0xa repeat-mask: 0xff So now, the dmz host cannot access HTTP services in the lan zone except for the one on host with IP address 10.215.144.66. Also, I set up a suricata drop rule/signature for http,and it was properly applied to the dmz host's navigation (it could access the HTTP service UNLESS it triggered that custom IPS rule). Well, if you see anything blatantly wrong here,please let me know. Vieri
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
