Suricata Inline Mode Not Blocking
-
Hi folks,
I've done a careful read through of this post:
https://forum.netgate.com/topic/138613/configuring-pfsense-netmap-for-suricata-inline-ips-mode-on-em-igb-interfacesWhat I'm trying to do is have pfSense and suricata act as a transparent firewall/IPS/IDS. I'm using an APU2D4 (Intel Pro 1000 nics). When I put suricata on the bridge interface, I get no alerts. If I put suricata on the WAN interface I get alerts, even saying they've dropped the packet, but it still gets through.
The test I've been doing from pfSense is:
curl http://testmyids.com.I have the rule set to block, and when doing the curl request, suricata logs:
03/07/2019-10:44:13.570305 [Drop] [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 217.160.0.187:80 -> 192.168.45.198:54834
However, curl is still getting the page contents. If I switch to legacy mode, it does block after the first connection.
From that previous post, here's the diagnostics:
ifconfig igb0 igb0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=1000b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,NETMAP> ether 00:0d:b9:4f:c4:18 hwaddr 00:0d:b9:4f:c4:18 inet6 fe80::20d:b9ff:fe4f:c418%igb0 prefixlen 64 scopeid 0x1 inet 192.168.45.198 netmask 0xffffff00 broadcast 192.168.45.255 nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active
sysctl -a | grep netmap device netmap dev.netmap.ixl_rx_miss_bufs: 0 dev.netmap.ixl_rx_miss: 0 dev.netmap.iflib_rx_miss_bufs: 0 dev.netmap.iflib_rx_miss: 0 dev.netmap.iflib_crcstrip: 1 dev.netmap.bridge_batch: 1024 dev.netmap.default_pipes: 0 dev.netmap.priv_buf_num: 4098 dev.netmap.priv_buf_size: 2048 dev.netmap.buf_curr_num: 163840 dev.netmap.buf_num: 163840 dev.netmap.buf_curr_size: 2048 dev.netmap.buf_size: 2048 dev.netmap.priv_ring_num: 4 dev.netmap.priv_ring_size: 20480 dev.netmap.ring_curr_num: 200 dev.netmap.ring_num: 200 dev.netmap.ring_curr_size: 36864 dev.netmap.ring_size: 36864 dev.netmap.priv_if_num: 1 dev.netmap.priv_if_size: 1024 dev.netmap.if_curr_num: 100 dev.netmap.if_num: 100 dev.netmap.if_curr_size: 1024 dev.netmap.if_size: 1024 dev.netmap.generic_rings: 1 dev.netmap.generic_ringsize: 1024 dev.netmap.generic_mit: 100000 dev.netmap.admode: 0 dev.netmap.fwd: 0 dev.netmap.flags: 0 dev.netmap.adaptive_io: 0 dev.netmap.txsync_retry: 2 dev.netmap.no_pendintr: 1 dev.netmap.mitigate: 1 dev.netmap.no_timestamp: 0 dev.netmap.verbose: 0 dev.netmap.ix_rx_miss_bufs: 0 dev.netmap.ix_rx_miss: 0 dev.netmap.ix_crcstrip: 0
sysctl -a | grep msi hw.ixl.enable_msix: 1 hw.sdhci.enable_msi: 1 hw.puc.msi_disable: 0 hw.pci.honor_msi_blacklist: 1 hw.pci.msix_rewrite_table: 0 hw.pci.enable_msix: 1 hw.pci.enable_msi: 1 hw.mfi.msi: 1 hw.malo.pci.msi_disable: 0 hw.ix.enable_msix: 1 hw.igb.enable_msix: 1 hw.em.enable_msix: 1 hw.cxgb.msi_allowed: 2 hw.bce.msi_enable: 1 hw.aac.enable_msi: 1 machdep.disable_msix_migration: 0
sysctl -a | grep igb device igb hw.igb.tx_process_limit: -1 hw.igb.rx_process_limit: 100 hw.igb.num_queues: 0 hw.igb.header_split: 0 hw.igb.max_interrupt_rate: 8000 hw.igb.enable_msix: 1 hw.igb.enable_aim: 1 hw.igb.txd: 1024 hw.igb.rxd: 1024 dev.igb.2.host.header_redir_missed: 0 dev.igb.2.host.serdes_violation_pkt: 0 dev.igb.2.host.length_errors: 0 dev.igb.2.host.tx_good_bytes: 3617488 dev.igb.2.host.rx_good_bytes: 1316381 dev.igb.2.host.breaker_tx_pkt_drop: 0 dev.igb.2.host.tx_good_pkt: 2 dev.igb.2.host.breaker_rx_pkt_drop: 0 dev.igb.2.host.breaker_rx_pkts: 0 dev.igb.2.host.rx_pkt: 1 dev.igb.2.host.host_tx_pkt_discard: 0 dev.igb.2.host.breaker_tx_pkt: 0 dev.igb.2.interrupts.rx_overrun: 0 dev.igb.2.interrupts.rx_desc_min_thresh: 0 dev.igb.2.interrupts.tx_queue_min_thresh: 9960 dev.igb.2.interrupts.tx_queue_empty: 10917 dev.igb.2.interrupts.tx_abs_timer: 0 dev.igb.2.interrupts.tx_pkt_timer: 0 dev.igb.2.interrupts.rx_abs_timer: 0 dev.igb.2.interrupts.rx_pkt_timer: 9959 dev.igb.2.interrupts.asserts: 33608 dev.igb.2.mac_stats.tso_ctx_fail: 0 dev.igb.2.mac_stats.tso_txd: 0 dev.igb.2.mac_stats.tx_frames_1024_1522: 1531 dev.igb.2.mac_stats.tx_frames_512_1023: 543 dev.igb.2.mac_stats.tx_frames_256_511: 216 dev.igb.2.mac_stats.tx_frames_128_255: 1257 dev.igb.2.mac_stats.tx_frames_65_127: 7357 dev.igb.2.mac_stats.tx_frames_64: 15 dev.igb.2.mac_stats.mcast_pkts_txd: 3 dev.igb.2.mac_stats.bcast_pkts_txd: 13 dev.igb.2.mac_stats.good_pkts_txd: 10919 dev.igb.2.mac_stats.total_pkts_txd: 10919 dev.igb.2.mac_stats.total_octets_txd: 3617488 dev.igb.2.mac_stats.good_octets_txd: 3617488 dev.igb.2.mac_stats.total_octets_recvd: 1345249 dev.igb.2.mac_stats.good_octets_recvd: 1316381 dev.igb.2.mac_stats.rx_frames_1024_1522: 1 dev.igb.2.mac_stats.rx_frames_512_1023: 704 dev.igb.2.mac_stats.rx_frames_256_511: 33 dev.igb.2.mac_stats.rx_frames_128_255: 2015 dev.igb.2.mac_stats.rx_frames_65_127: 5824 dev.igb.2.mac_stats.rx_frames_64: 1383 dev.igb.2.mac_stats.mcast_pkts_recvd: 0 dev.igb.2.mac_stats.bcast_pkts_recvd: 7 dev.igb.2.mac_stats.good_pkts_recvd: 9960 dev.igb.2.mac_stats.total_pkts_recvd: 10100 dev.igb.2.mac_stats.mgmt_pkts_txd: 0 dev.igb.2.mac_stats.mgmt_pkts_drop: 0 dev.igb.2.mac_stats.mgmt_pkts_recvd: 0 dev.igb.2.mac_stats.unsupported_fc_recvd: 0 dev.igb.2.mac_stats.xoff_txd: 0 dev.igb.2.mac_stats.xoff_recvd: 0 dev.igb.2.mac_stats.xon_txd: 0 dev.igb.2.mac_stats.xon_recvd: 0 dev.igb.2.mac_stats.coll_ext_errs: 0 dev.igb.2.mac_stats.tx_no_crs: 0 dev.igb.2.mac_stats.alignment_errs: 0 dev.igb.2.mac_stats.crc_errs: 0 dev.igb.2.mac_stats.recv_errs: 0 dev.igb.2.mac_stats.recv_jabber: 0 dev.igb.2.mac_stats.recv_oversize: 0 dev.igb.2.mac_stats.recv_fragmented: 0 dev.igb.2.mac_stats.recv_undersize: 0 dev.igb.2.mac_stats.recv_no_buff: 0 dev.igb.2.mac_stats.recv_length_errors: 0 dev.igb.2.mac_stats.missed_packets: 0 dev.igb.2.mac_stats.defer_count: 0 dev.igb.2.mac_stats.sequence_errors: 0 dev.igb.2.mac_stats.symbol_errors: 0 dev.igb.2.mac_stats.collision_count: 0 dev.igb.2.mac_stats.late_coll: 0 dev.igb.2.mac_stats.multiple_coll: 0 dev.igb.2.mac_stats.single_coll: 0 dev.igb.2.mac_stats.excess_coll: 0 dev.igb.2.queue3.lro_flushed: 0 dev.igb.2.queue3.lro_queued: 0 dev.igb.2.queue3.rx_bytes: 210221 dev.igb.2.queue3.rx_packets: 1449 dev.igb.2.queue3.rxd_tail: 424 dev.igb.2.queue3.rxd_head: 425 dev.igb.2.queue3.tx_packets: 0 dev.igb.2.queue3.no_desc_avail: 0 dev.igb.2.queue3.txd_tail: 0 dev.igb.2.queue3.txd_head: 0 dev.igb.2.queue3.interrupt_rate: 83333 dev.igb.2.queue2.lro_flushed: 0 dev.igb.2.queue2.lro_queued: 0 dev.igb.2.queue2.rx_bytes: 201018 dev.igb.2.queue2.rx_packets: 1373 dev.igb.2.queue2.rxd_tail: 348 dev.igb.2.queue2.rxd_head: 349 dev.igb.2.queue2.tx_packets: 4 dev.igb.2.queue2.no_desc_avail: 0 dev.igb.2.queue2.txd_tail: 14 dev.igb.2.queue2.txd_head: 14 dev.igb.2.queue2.interrupt_rate: 100000 dev.igb.2.queue1.lro_flushed: 0 dev.igb.2.queue1.lro_queued: 0 dev.igb.2.queue1.rx_bytes: 528772 dev.igb.2.queue1.rx_packets: 4178 dev.igb.2.queue1.rxd_tail: 81 dev.igb.2.queue1.rxd_head: 82 dev.igb.2.queue1.tx_packets: 0 dev.igb.2.queue1.no_desc_avail: 0 dev.igb.2.queue1.txd_tail: 0 dev.igb.2.queue1.txd_head: 0 dev.igb.2.queue1.interrupt_rate: 90909 dev.igb.2.queue0.lro_flushed: 0 dev.igb.2.queue0.lro_queued: 0 dev.igb.2.queue0.rx_bytes: 339932 dev.igb.2.queue0.rx_packets: 3011 dev.igb.2.queue0.rxd_tail: 962 dev.igb.2.queue0.rxd_head: 964 dev.igb.2.queue0.tx_packets: 10992 dev.igb.2.queue0.no_desc_avail: 0 dev.igb.2.queue0.txd_tail: 100 dev.igb.2.queue0.txd_head: 101 dev.igb.2.queue0.interrupt_rate: 90909 dev.igb.2.fc_low_water: 31312 dev.igb.2.fc_high_water: 31328 dev.igb.2.rx_buf_alloc: 0 dev.igb.2.tx_buf_alloc: 0 dev.igb.2.extended_int_mask: 2147483679 dev.igb.2.interrupt_mask: 4 dev.igb.2.rx_control: 71335938 dev.igb.2.device_control: 1477706305 dev.igb.2.watchdog_timeouts: 0 dev.igb.2.rx_overruns: 0 dev.igb.2.tx_dma_fail: 0 dev.igb.2.mbuf_defrag_fail: 0 dev.igb.2.link_irq: 2 dev.igb.2.dropped: 0 dev.igb.2.eee_disabled: 0 dev.igb.2.dmac: 0 dev.igb.2.tx_processing_limit: -1 dev.igb.2.rx_processing_limit: 100 dev.igb.2.fc: 0 dev.igb.2.enable_aim: 1 dev.igb.2.nvm: -1 dev.igb.2.%parent: pci3 dev.igb.2.%pnpinfo: vendor=0x8086 device=0x157b subvendor=0x8086 subdevice=0x0000 class=0x020000 dev.igb.2.%location: slot=0 function=0 dbsf=pci0:3:0:0 dev.igb.2.%driver: igb dev.igb.2.%desc: Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k dev.igb.1.host.header_redir_missed: 0 dev.igb.1.host.serdes_violation_pkt: 0 dev.igb.1.host.length_errors: 0 dev.igb.1.host.tx_good_bytes: 0 dev.igb.1.host.rx_good_bytes: 0 dev.igb.1.host.breaker_tx_pkt_drop: 0 dev.igb.1.host.tx_good_pkt: 0 dev.igb.1.host.breaker_rx_pkt_drop: 0 dev.igb.1.host.breaker_rx_pkts: 0 dev.igb.1.host.rx_pkt: 0 dev.igb.1.host.host_tx_pkt_discard: 0 dev.igb.1.host.breaker_tx_pkt: 0 dev.igb.1.interrupts.rx_overrun: 0 dev.igb.1.interrupts.rx_desc_min_thresh: 0 dev.igb.1.interrupts.tx_queue_min_thresh: 0 dev.igb.1.interrupts.tx_queue_empty: 0 dev.igb.1.interrupts.tx_abs_timer: 0 dev.igb.1.interrupts.tx_pkt_timer: 0 dev.igb.1.interrupts.rx_abs_timer: 0 dev.igb.1.interrupts.rx_pkt_timer: 0 dev.igb.1.interrupts.asserts: 12077 dev.igb.1.mac_stats.tso_ctx_fail: 0 dev.igb.1.mac_stats.tso_txd: 0 dev.igb.1.mac_stats.tx_frames_1024_1522: 0 dev.igb.1.mac_stats.tx_frames_512_1023: 0 dev.igb.1.mac_stats.tx_frames_256_511: 0 dev.igb.1.mac_stats.tx_frames_128_255: 0 dev.igb.1.mac_stats.tx_frames_65_127: 0 dev.igb.1.mac_stats.tx_frames_64: 0 dev.igb.1.mac_stats.mcast_pkts_txd: 0 dev.igb.1.mac_stats.bcast_pkts_txd: 0 dev.igb.1.mac_stats.good_pkts_txd: 0 dev.igb.1.mac_stats.total_pkts_txd: 0 dev.igb.1.mac_stats.total_octets_txd: 0 dev.igb.1.mac_stats.good_octets_txd: 0 dev.igb.1.mac_stats.total_octets_recvd: 0 dev.igb.1.mac_stats.good_octets_recvd: 0 dev.igb.1.mac_stats.rx_frames_1024_1522: 0 dev.igb.1.mac_stats.rx_frames_512_1023: 0 dev.igb.1.mac_stats.rx_frames_256_511: 0 dev.igb.1.mac_stats.rx_frames_128_255: 0 dev.igb.1.mac_stats.rx_frames_65_127: 0 dev.igb.1.mac_stats.rx_frames_64: 0 dev.igb.1.mac_stats.mcast_pkts_recvd: 0 dev.igb.1.mac_stats.bcast_pkts_recvd: 0 dev.igb.1.mac_stats.good_pkts_recvd: 0 dev.igb.1.mac_stats.total_pkts_recvd: 0 dev.igb.1.mac_stats.mgmt_pkts_txd: 0 dev.igb.1.mac_stats.mgmt_pkts_drop: 0 dev.igb.1.mac_stats.mgmt_pkts_recvd: 0 dev.igb.1.mac_stats.unsupported_fc_recvd: 0 dev.igb.1.mac_stats.xoff_txd: 0 dev.igb.1.mac_stats.xoff_recvd: 0 dev.igb.1.mac_stats.xon_txd: 0 dev.igb.1.mac_stats.xon_recvd: 0 dev.igb.1.mac_stats.coll_ext_errs: 0 dev.igb.1.mac_stats.tx_no_crs: 0 dev.igb.1.mac_stats.alignment_errs: 0 dev.igb.1.mac_stats.crc_errs: 0 dev.igb.1.mac_stats.recv_errs: 0 dev.igb.1.mac_stats.recv_jabber: 0 dev.igb.1.mac_stats.recv_oversize: 0 dev.igb.1.mac_stats.recv_fragmented: 0 dev.igb.1.mac_stats.recv_undersize: 0 dev.igb.1.mac_stats.recv_no_buff: 0 dev.igb.1.mac_stats.recv_length_errors: 0 dev.igb.1.mac_stats.missed_packets: 0 dev.igb.1.mac_stats.defer_count: 0 dev.igb.1.mac_stats.sequence_errors: 0 dev.igb.1.mac_stats.symbol_errors: 0 dev.igb.1.mac_stats.collision_count: 0 dev.igb.1.mac_stats.late_coll: 0 dev.igb.1.mac_stats.multiple_coll: 0 dev.igb.1.mac_stats.single_coll: 0 dev.igb.1.mac_stats.excess_coll: 0 dev.igb.1.queue3.lro_flushed: 0 dev.igb.1.queue3.lro_queued: 0 dev.igb.1.queue3.rx_bytes: 0 dev.igb.1.queue3.rx_packets: 0 dev.igb.1.queue3.rxd_tail: 1023 dev.igb.1.queue3.rxd_head: 0 dev.igb.1.queue3.tx_packets: 0 dev.igb.1.queue3.no_desc_avail: 0 dev.igb.1.queue3.txd_tail: 0 dev.igb.1.queue3.txd_head: 0 dev.igb.1.queue3.interrupt_rate: 8000 dev.igb.1.queue2.lro_flushed: 0 dev.igb.1.queue2.lro_queued: 0 dev.igb.1.queue2.rx_bytes: 0 dev.igb.1.queue2.rx_packets: 0 dev.igb.1.queue2.rxd_tail: 1023 dev.igb.1.queue2.rxd_head: 0 dev.igb.1.queue2.tx_packets: 0 dev.igb.1.queue2.no_desc_avail: 0 dev.igb.1.queue2.txd_tail: 0 dev.igb.1.queue2.txd_head: 0 dev.igb.1.queue2.interrupt_rate: 8000 dev.igb.1.queue1.lro_flushed: 0 dev.igb.1.queue1.lro_queued: 0 dev.igb.1.queue1.rx_bytes: 0 dev.igb.1.queue1.rx_packets: 0 dev.igb.1.queue1.rxd_tail: 1023 dev.igb.1.queue1.rxd_head: 0 dev.igb.1.queue1.tx_packets: 0 dev.igb.1.queue1.no_desc_avail: 0 dev.igb.1.queue1.txd_tail: 0 dev.igb.1.queue1.txd_head: 0 dev.igb.1.queue1.interrupt_rate: 8000 dev.igb.1.queue0.lro_flushed: 0 dev.igb.1.queue0.lro_queued: 0 dev.igb.1.queue0.rx_bytes: 0 dev.igb.1.queue0.rx_packets: 0 dev.igb.1.queue0.rxd_tail: 1023 dev.igb.1.queue0.rxd_head: 0 dev.igb.1.queue0.tx_packets: 0 dev.igb.1.queue0.no_desc_avail: 0 dev.igb.1.queue0.txd_tail: 0 dev.igb.1.queue0.txd_head: 0 dev.igb.1.queue0.interrupt_rate: 8000 dev.igb.1.fc_low_water: 31312 dev.igb.1.fc_high_water: 31328 dev.igb.1.rx_buf_alloc: 0 dev.igb.1.tx_buf_alloc: 0 dev.igb.1.extended_int_mask: 2147483679 dev.igb.1.interrupt_mask: 4 dev.igb.1.rx_control: 71335962 dev.igb.1.device_control: 1209795137 dev.igb.1.watchdog_timeouts: 0 dev.igb.1.rx_overruns: 0 dev.igb.1.tx_dma_fail: 0 dev.igb.1.mbuf_defrag_fail: 0 dev.igb.1.link_irq: 1 dev.igb.1.dropped: 0 dev.igb.1.eee_disabled: 0 dev.igb.1.dmac: 0 dev.igb.1.tx_processing_limit: -1 dev.igb.1.rx_processing_limit: 100 dev.igb.1.fc: 0 dev.igb.1.enable_aim: 1 dev.igb.1.nvm: -1 dev.igb.1.%parent: pci2 dev.igb.1.%pnpinfo: vendor=0x8086 device=0x157b subvendor=0x8086 subdevice=0x0000 class=0x020000 dev.igb.1.%location: slot=0 function=0 dbsf=pci0:2:0:0 dev.igb.1.%driver: igb dev.igb.1.%desc: Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k dev.igb.0.host.header_redir_missed: 0 dev.igb.0.host.serdes_violation_pkt: 0 dev.igb.0.host.length_errors: 0 dev.igb.0.host.tx_good_bytes: 523683 dev.igb.0.host.rx_good_bytes: 2568190 dev.igb.0.host.breaker_tx_pkt_drop: 0 dev.igb.0.host.tx_good_pkt: 14 dev.igb.0.host.breaker_rx_pkt_drop: 0 dev.igb.0.host.breaker_rx_pkts: 0 dev.igb.0.host.rx_pkt: 5 dev.igb.0.host.host_tx_pkt_discard: 0 dev.igb.0.host.breaker_tx_pkt: 0 dev.igb.0.interrupts.rx_overrun: 0 dev.igb.0.interrupts.rx_desc_min_thresh: 0 dev.igb.0.interrupts.tx_queue_min_thresh: 15226 dev.igb.0.interrupts.tx_queue_empty: 7506 dev.igb.0.interrupts.tx_abs_timer: 0 dev.igb.0.interrupts.tx_pkt_timer: 0 dev.igb.0.interrupts.rx_abs_timer: 0 dev.igb.0.interrupts.rx_pkt_timer: 15221 dev.igb.0.interrupts.asserts: 34802 dev.igb.0.mac_stats.tso_ctx_fail: 0 dev.igb.0.mac_stats.tso_txd: 0 dev.igb.0.mac_stats.tx_frames_1024_1522: 0 dev.igb.0.mac_stats.tx_frames_512_1023: 8 dev.igb.0.mac_stats.tx_frames_256_511: 7 dev.igb.0.mac_stats.tx_frames_128_255: 9 dev.igb.0.mac_stats.tx_frames_65_127: 1513 dev.igb.0.mac_stats.tx_frames_64: 5982 dev.igb.0.mac_stats.mcast_pkts_txd: 21 dev.igb.0.mac_stats.bcast_pkts_txd: 55 dev.igb.0.mac_stats.good_pkts_txd: 7519 dev.igb.0.mac_stats.total_pkts_txd: 7519 dev.igb.0.mac_stats.total_octets_txd: 523619 dev.igb.0.mac_stats.good_octets_txd: 523619 dev.igb.0.mac_stats.total_octets_recvd: 2568190 dev.igb.0.mac_stats.good_octets_recvd: 2568190 dev.igb.0.mac_stats.rx_frames_1024_1522: 223 dev.igb.0.mac_stats.rx_frames_512_1023: 195 dev.igb.0.mac_stats.rx_frames_256_511: 3529 dev.igb.0.mac_stats.rx_frames_128_255: 2462 dev.igb.0.mac_stats.rx_frames_65_127: 2210 dev.igb.0.mac_stats.rx_frames_64: 6607 dev.igb.0.mac_stats.mcast_pkts_recvd: 1291 dev.igb.0.mac_stats.bcast_pkts_recvd: 6547 dev.igb.0.mac_stats.good_pkts_recvd: 15226 dev.igb.0.mac_stats.total_pkts_recvd: 15226 dev.igb.0.mac_stats.mgmt_pkts_txd: 0 dev.igb.0.mac_stats.mgmt_pkts_drop: 0 dev.igb.0.mac_stats.mgmt_pkts_recvd: 0 dev.igb.0.mac_stats.unsupported_fc_recvd: 0 dev.igb.0.mac_stats.xoff_txd: 0 dev.igb.0.mac_stats.xoff_recvd: 0 dev.igb.0.mac_stats.xon_txd: 0 dev.igb.0.mac_stats.xon_recvd: 0 dev.igb.0.mac_stats.coll_ext_errs: 0 dev.igb.0.mac_stats.tx_no_crs: 0 dev.igb.0.mac_stats.alignment_errs: 0 dev.igb.0.mac_stats.crc_errs: 0 dev.igb.0.mac_stats.recv_errs: 0 dev.igb.0.mac_stats.recv_jabber: 0 dev.igb.0.mac_stats.recv_oversize: 0 dev.igb.0.mac_stats.recv_fragmented: 0 dev.igb.0.mac_stats.recv_undersize: 0 dev.igb.0.mac_stats.recv_no_buff: 0 dev.igb.0.mac_stats.recv_length_errors: 0 dev.igb.0.mac_stats.missed_packets: 0 dev.igb.0.mac_stats.defer_count: 0 dev.igb.0.mac_stats.sequence_errors: 0 dev.igb.0.mac_stats.symbol_errors: 0 dev.igb.0.mac_stats.collision_count: 0 dev.igb.0.mac_stats.late_coll: 0 dev.igb.0.mac_stats.multiple_coll: 0 dev.igb.0.mac_stats.single_coll: 0 dev.igb.0.mac_stats.excess_coll: 0 dev.igb.0.queue3.lro_flushed: 0 dev.igb.0.queue3.lro_queued: 0 dev.igb.0.queue3.rx_bytes: 0 dev.igb.0.queue3.rx_packets: 80 dev.igb.0.queue3.rxd_tail: 469 dev.igb.0.queue3.rxd_head: 470 dev.igb.0.queue3.tx_packets: 0 dev.igb.0.queue3.no_desc_avail: 0 dev.igb.0.queue3.txd_tail: 0 dev.igb.0.queue3.txd_head: 0 dev.igb.0.queue3.interrupt_rate: 8000 dev.igb.0.queue2.lro_flushed: 0 dev.igb.0.queue2.lro_queued: 0 dev.igb.0.queue2.rx_bytes: 0 dev.igb.0.queue2.rx_packets: 59 dev.igb.0.queue2.rxd_tail: 235 dev.igb.0.queue2.rxd_head: 236 dev.igb.0.queue2.tx_packets: 0 dev.igb.0.queue2.no_desc_avail: 0 dev.igb.0.queue2.txd_tail: 0 dev.igb.0.queue2.txd_head: 0 dev.igb.0.queue2.interrupt_rate: 8000 dev.igb.0.queue1.lro_flushed: 0 dev.igb.0.queue1.lro_queued: 0 dev.igb.0.queue1.rx_bytes: 0 dev.igb.0.queue1.rx_packets: 213 dev.igb.0.queue1.rxd_tail: 371 dev.igb.0.queue1.rxd_head: 372 dev.igb.0.queue1.tx_packets: 13 dev.igb.0.queue1.no_desc_avail: 0 dev.igb.0.queue1.txd_tail: 0 dev.igb.0.queue1.txd_head: 0 dev.igb.0.queue1.interrupt_rate: 100000 dev.igb.0.queue0.lro_flushed: 0 dev.igb.0.queue0.lro_queued: 0 dev.igb.0.queue0.rx_bytes: 0 dev.igb.0.queue0.rx_packets: 74 dev.igb.0.queue0.rxd_tail: 307 dev.igb.0.queue0.rxd_head: 308 dev.igb.0.queue0.tx_packets: 298 dev.igb.0.queue0.no_desc_avail: 0 dev.igb.0.queue0.txd_tail: 154 dev.igb.0.queue0.txd_head: 154 dev.igb.0.queue0.interrupt_rate: 8000 dev.igb.0.fc_low_water: 31312 dev.igb.0.fc_high_water: 31328 dev.igb.0.rx_buf_alloc: 0 dev.igb.0.tx_buf_alloc: 0 dev.igb.0.extended_int_mask: 2147483679 dev.igb.0.interrupt_mask: 4 dev.igb.0.rx_control: 71335962 dev.igb.0.device_control: 1075577409 dev.igb.0.watchdog_timeouts: 0 dev.igb.0.rx_overruns: 0 dev.igb.0.tx_dma_fail: 0 dev.igb.0.mbuf_defrag_fail: 0 dev.igb.0.link_irq: 12 dev.igb.0.dropped: 0 dev.igb.0.eee_disabled: 0 dev.igb.0.dmac: 0 dev.igb.0.tx_processing_limit: -1 dev.igb.0.rx_processing_limit: 100 dev.igb.0.fc: 0 dev.igb.0.enable_aim: 1 dev.igb.0.nvm: -1 dev.igb.0.%parent: pci1 dev.igb.0.%pnpinfo: vendor=0x8086 device=0x157b subvendor=0x8086 subdevice=0x0000 class=0x020000 dev.igb.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 dev.igb.0.%driver: igb dev.igb.0.%desc: Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k dev.igb.%parent:
sysctl -a | grep rss device wlan_rssadapt hw.bxe.udp_rss: 0 hw.ix.enable_rss: 1
cat /var/log/system.log | grep netmap Mar 7 15:16:36 pfSense kernel: netmap: loaded module Mar 7 15:16:36 pfSense kernel: igb0: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 15:16:36 pfSense kernel: igb1: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 15:16:36 pfSense kernel: igb2: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 20:49:49 pfSense kernel: netmap: loaded module Mar 7 20:49:49 pfSense kernel: igb0: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 20:49:49 pfSense kernel: igb1: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 20:49:49 pfSense kernel: igb2: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 8 03:07:13 pfSense kernel: netmap: loaded module Mar 8 03:07:13 pfSense kernel: igb0: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 8 03:07:14 pfSense kernel: igb1: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 8 03:07:14 pfSense kernel: igb2: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 08:40:04 pfSense kernel: netmap: loaded module Mar 7 08:40:04 pfSense kernel: igb0: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 08:40:04 pfSense kernel: igb1: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 08:40:04 pfSense kernel: igb2: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 08:56:10 pfSense kernel: netmap: loaded module Mar 7 08:56:10 pfSense kernel: igb0: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 08:56:10 pfSense kernel: igb1: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 08:56:10 pfSense kernel: igb2: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 09:09:25 pfSense kernel: 565.540396 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 09:09:25 pfSense kernel: 565.567166 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 09:15:27 pfSense kernel: 927.025114 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 09:17:50 pfSense kernel: 070.415252 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 09:17:50 pfSense kernel: 070.444352 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 09:18:46 pfSense kernel: 126.218283 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 09:45:46 pfSense kernel: 746.263552 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 09:45:46 pfSense kernel: 746.290481 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 09:45:46 pfSense kernel: 746.703129 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 09:45:53 pfSense kernel: 753.723313 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 09:45:53 pfSense kernel: 753.750241 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 09:46:35 pfSense kernel: 795.391574 [ 760] generic_netmap_dtor Restored native NA 0 Mar 7 10:06:42 pfSense kernel: netmap: loaded module Mar 7 10:06:42 pfSense kernel: igb0: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 10:06:42 pfSense kernel: igb1: netmap queues/slots: TX 4/1024, RX 4/1024 Mar 7 10:06:42 pfSense kernel: igb2: netmap queues/slots: TX 4/1024, RX 4/1024
cat /var/log/system.log | grep sig Mar 7 15:17:46 pfSense syslogd: exiting on signal 15 Mar 7 15:19:27 pfSense syslogd: exiting on signal 15 Mar 7 20:50:27 pfSense syslogd: exiting on signal 15 Mar 8 03:08:02 pfSense syslogd: exiting on signal 15 Mar 7 08:38:12 pfSense syslogd: exiting on signal 15 Mar 7 08:40:45 pfSense syslogd: exiting on signal 15 Mar 7 08:56:11 pfSense syslogd: Logging subprocess 5511 (exec /usr/local/sbin/sshguard) exited due to signal 15. Mar 7 08:56:54 pfSense syslogd: exiting on signal 15 Mar 7 10:05:06 pfSense syslogd: exiting on signal 15 Mar 7 10:06:43 pfSense syslogd: Logging subprocess 7875 (exec /usr/local/sbin/sshguard) exited due to signal 15. Mar 7 10:07:26 pfSense syslogd: exiting on signal 15
cat /var/log/suricata/suricata_*/suricata.log | grep -m 1 "signatures processed" 7/3/2019 -- 10:43:36 - <Info> -- 394 signatures processed. 0 are IP-only rules, 97 are inspecting packet payload, 182 inspect application layer, 102 are decoder event only
-
Netmap is not likely to play very well with a transparent firewall bridge setup, especially with the way netmap is currently implemented within Suricata. Some improvements are planned upstream for netmap, but there is not yet a timetable for their release.
Also note that Suricata will not work properly with a PPPoE type interface. I mention that because that is a popular type of setup for a WAN. The most popular is DHCP, but there are lots of PPPoE connections. The least popular setup is a static IP on the WAN.
If you want to continue with the transparent firewall arrangement, I recommend you use Legacy Mode blocking.