5

Trying to write a snort rule that prevents the system (using its IP) from accessing a specific website, tried this up to now.

alert tcp any any <> 'ipaddress' any (content: "web url"; msg: "Access Denied"; react:block; sid:1000005;)

Any ideas on why this won't work?

justinmartin123
  • 51
  • 1
  • 1
  • 2

2 Answers2

3

Snort has several actions which can be used:

  • alert generate an alert using the selected alert method, and then log the packet
  • log log the packet
  • pass ignore the packet
  • activate alert and then turn on another dynamic rule
  • dynamic remain idle until activated by an activate rule , then act as a log rule
  • drop block and log the packet
  • reject block the packet, log it, and then send a TCP reset if the protocol is TCP or an ICMP port unreachable message if the protocol is UDP.
  • sdrop block the packet but do not log it.

These can be found on the documentation page Snort Rule Headers

In your situation you want either drop, reject or sdrop, depending on whether you want to send a reset, and either log or not.

The reason your current one will not block is that alert will just log the packet.

Jon Taylor
  • 7,865
  • 5
  • 30
  • 55
0

I'm not totally certain, but it may be that you are using alert which alerts the IDS where you should be using drop which just drops packets going to the specified URL.

Jack Wilson
  • 3
  • 1
  • 4