From cf44d8d149dbda8aa8dccd89dd5e3ff75af628b9 Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Tue, 17 Sep 2024 04:04:07 +0200 Subject: [PATCH] firewall: Move the IPS back to INPUT/FORWARD/OUTPUT We cannot use the PREROUTING/POSTROUTING chains here because Suricata will fail to track NAT-ed connections. Signed-off-by: Michael Tremer --- src/initscripts/system/firewall | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 7dbbe38cb..ab4833a7f 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -378,7 +378,7 @@ iptables_init() { # IPS (Suricata) chains iptables -t mangle -N IPS - for chain in PREROUTING POSTROUTING; do + for chain in INPUT FORWARD OUTPUT; do iptables -t mangle -A "${chain}" -j IPS done -- 2.39.5