From 20edd42bf67af240ea65537a0d313dcb25ae0507 Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Sat, 21 Sep 2024 12:39:32 +0200 Subject: [PATCH] suricata: Always count the whitelisted packets Even if there are no rules, if this does not exist, collectd will be unhappy and we cannot generate the graph. Signed-off-by: Michael Tremer --- src/initscripts/system/suricata | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index a80a32f78..86836ee8c 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -129,13 +129,13 @@ generate_fw_rules() { iptables -w -t mangle -A IPS -s "${network}" -j MARK --set-mark "$(( IPS_WHITELISTED_MARK ))/$(( IPS_WHITELISTED_MASK ))" iptables -w -t mangle -A IPS -d "${network}" -j MARK --set-mark "$(( IPS_WHITELISTED_MARK ))/$(( IPS_WHITELISTED_MASK ))" done < "/var/ipfire/suricata/ignored" - - # Count and skip the whitelisted packets - iptables -w -t mangle -A IPS \ - -m comment --comment "WHITELISTED" \ - -m mark --mark "$(( IPS_WHITELISTED_MARK ))/$(( IPS_WHITELISTED_MASK ))" -j RETURN fi + # Count and skip the whitelisted packets + iptables -w -t mangle -A IPS \ + -m comment --comment "WHITELISTED" \ + -m mark --mark "$(( IPS_WHITELISTED_MARK ))/$(( IPS_WHITELISTED_MASK ))" -j RETURN + # Send packets to suricata iptables -w -t mangle -A IPS -m comment --comment "SCANNED" -j NFQUEUE "${NFQ_OPTIONS[@]}" -- 2.39.5