'Snort is not dropping the traffic or blocking the website
I used this snort rule to block a website but it is not blocking the website. I already made the mode inline but still it is not working. Can anyone help me in this regard?? It would be really helpful for me. BTW I installed snort in ubuntu OS in Virtual box. Although in below screenshot you can see that it is showing that it already dropped the packet but actually i still can browse the website. Thanks.
here is the rule: drop http $HOME_NET any -> 34.102.136.180 $HTTP_PORTS (msg:"Dropping packets"; flow:to_server,established; http_uri; metadata: service http; priority:1; sid:10000001; rev:1; )>
Command I used: sudo snort -Q -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -i enp0s3 -A alert_fast -s 65535 -k none
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|