From 0ab5c8f9e264b49fc8ef43ee1b7939912b013b6a Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Wed, 18 Aug 2021 16:18:50 +0100 Subject: [PATCH] suricata: Add rule to skip IPS if a packet has the bypass bit set Signed-off-by: Michael Tremer --- src/initscripts/system/suricata | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index 5ccea93914..2577621b8f 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -134,6 +134,12 @@ function generate_fw_rules { # Flush the firewall chains. flush_fw_chain + # Skip anything that has the bypass bit set + local chain + for chain in "${IPS_INPUT_CHAIN}" "${IPS_FORWARD_CHAIN}" "${IPS_OUTPUT_CHAIN}"; do + iptables -w -A "${chain}" -m mark --mark "${BYPASS_MARK}/${BYPASS_MASK}" -j RETURN + done + # Check if the array of enabled_ips_zones contains any elements. if [[ ${enabled_ips_zones[@]} ]]; then # Loop through the array and create firewall rules. -- 2.39.5