More interestingly, there are tools that will convert snort signatures into iptables-aware format (even with hex string support), enabling intrusion prevention at the kernel space and stopping the attacks before they occur. Having said all that, I shall show you how to put things together:

First thing you need to do is to grab all the required packages:

1. Kernel source code which has Netfilter kernel-space code integrated and compatible with the latest Netfilter user-space code (version 2.4.18+) . The latest stable version can be downloaded at (http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.21.tar.bz2)
2. Netfilter user-space code which is now iptables, (latest version is 1.2.8) but currently only version 1.2.7a supports hex string patch (http://www.netfilter.org/files/iptables-1.2.7a.tar.bz2) and the corresponding patch-o-matic package (http://www.netfilter.org/files/patch-o-matic-20030107.tar.bz2)
3. FWSnort, a perl script that will convert most snort rules into iptables rules. Don't forget to grab a hex string support patch that adds a hex-string capability to libipt_string.c to iptables source also. All these stuff are available at (http://www.cipherdyne.com/fwsnort/)

Unpacking them in appropriate directory:

Apply libipt_string patch to iptables source and build iptables kernel and user spaces code:

Next step is to apply a string match support from a patch-o-matic package. A patch-o-matic is a series of Netfilter add-ons that provides extra functionality to original Netfilter. It has a nice automated script that will allow you to choose which patches you want integrated and checks their dependencies.

You should be aware that,some patches might not work with one another, so carefully read the comments before you apply any patches. In this case, we will apply only string-match support patch:

This patch is not of our interest, so answer no (N) to go to the next one. Keep going until you find our string-match (-m string -string) patch and answer yes (y) to apply it:

Now, go back to the directory where you unpacked the kernel source and proceed with the compilation. (If you have compiled your own kernel before, you can just skip reading this section), Instructions on how to compile and customize your kernel can be read at (http:// www.tldp.org/HOWTO/Kernel-HOWTO.html)

Finally, we are done with building all the components, reboot the system and enjoy your new toy.

Now let's test this new functionality and use it as an active defense system:

# This rule rejects all incoming mails with a string of "Buy Now" which many people consider it #as spam

# Blocks superscan ping but allows other types ping

# This will reset any connection that attempts to access a shell, in which you will find in most exploit codes

Let's see if it works, on the server side execute nc -vv -l -p 23, on the remote host execute:

# Thanks to hex string support, now we can easily block x86 NOOP sleds used in most buffer overflow exploits (use this with care, since it is possible that binary files transfer in e-mail may contain these strings and will get dropped!)

You can try any buffer overflow exploits and will find that most of them get silently dropped!

Now, you begin to have some idea on how to use this new feature as a content-based firewall system either for your local host or internal network. The FWSnort script that you have downloaded in the beginning will come into play as we will use it to convert some snort signatures into iptables rules.

First unpack the source and install it:

Edit the configuration /etc/fwsnort/fwsnort.conf file to suit your needs and start the conversion:

A converted set of snort rules will be written to /etc/fwsnort/fwsnort.sh in a form of a shell script. Modify it again to suit your need , and merge it with your existing firewall rule. One thing you should keep in mind when working with a large iptables rules is that, everytime you perform an APPEND or INSERT, iptables will allocate a memory and invoke this function every time , resulting in a very slow performance. Iptables has a solution to this problem by providing you scripts that will load a large rule set into the kernel very quickly or dump the current rule set from the kernel into iptables configuration file. So I suggest you first run your firewall script and then save it as iptables format using the command:

Then whenever you need to reload the firewall rule-set you simply issue the command iptables-restore , and all rules will be reloaded in a much faster manner.

Up to this point, you may think that if this functionality is so powerful, why doesn't anyone use it in replacement for snort? Although, Netfilter can perform a stateful inspection of content in a packet at the network level, it still lacks advanced capabilities in handling fragmented packets, polymorphic shell codes, traffic normalization, etc. Snort, on the other hands, can perform a pattern matching using a much faster algorithm called Boyer-Moore, supports a stateful packet analysis and stream reassembly. If you are interested in using snort as defense system, there is an ongoing honeypot project (http://project.honeynet.org) that uses a modified version of snort called snort_inline and a special set of firewall rules to achieve a hybrid firewall system.

In conclusion, I would like to comment that intrusion prevention is still at its early stage and there is no out-of-the-box product that will perfectly fits your requirements. Every network has its own culture and usage behavior thus needs a distinctly unique tuning. Don't simply rely on a single tool but do correlate data from various sources and use them to understand your network and improve your security infrastructure.