Dear all,

We use SNORT rules to match on specific traffic (inline mode) between two network interface cards.

This is working perfect.

But we would like to route the packet from a specific matching rule:

alert tcp any any -> 192.168.1.2 3306 ( msg:"Sample alert 192.168.1.2:3306"; sid:87657292; rev:1; )

to another ip then the specified destination.
(we had this working with bridge utils (Centos 7) using ebtables and iptables, but had to give up the bridge configuration due to the inline Snort solution.

Any idea how to deal with this issue?

Probably with NFQUEUE?

1 members found this post helpful.

thank you for the reply,

we have looked to nfqueue, but decided to set up a bridge, only allowing the requested port, and set up snort routing eveything except the desired port.

KR