|Main Archive Page > Month Archives > snort-users archives|
I configured Snort 18.104.22.168 with --with-mysql --enable-inline on Ubuntu Linux
I made an iptables entry to pass all outgoing ICMP packets to ip_queue: "iptables -A OUTPUT -p icmp -j QUEUE".
I started the ip_queue service using "modprobe ip_queue". Then i started Snort using "snort -Qc *configfilelocation*". My Snort rule is very simple: "drop icmp *myip* any -> *other_ip* any (sid: *my_rule_id*;)"
The problem is that it seems like it ignores my Snort rule and drops all ICMP packets, not just the ones targeted to *other_ip*. Even if i stop running Snort, i cannot ping any ip's. Why is this happening? Should i make a rule inside the QUEUE chain to pass back the packets to another chain? It looks like the packets are stuck in QUEUE.
Any help appreciated,