Suricata dont drop packets

Question

I have a server with Suricata (169.69.1.11) installed and a specific rule:

drop ICMP any any -> 169.69.1.11 any (msg: "ping dropped";sid:10001;)

In other VM I execute:

ping 169.69.1.11 -c 5

so at this point, everything is bad because the pings reach, and nothing is registered on fast.log so I execute on the Suricata machine

sudo suricata -i enp0s8

and I ping another time with the same command ( 5 pings ) In my other machine every seems okay, the 5 pings seems they reach, but I look at the logs on Suricata /var/log/suricata/fast.log it drops that line

03/25/2022-11:11:05.231735  [wDrop] [**] [1:10001:0] ping dropped [**] [Classification: (null)] [Priority: 3] {ICMP} 169.69.1.10:8 -> 169.69.1.11:0

Why the pings are hitting and don't get blocked? Why do I ping 5 times but only 1 time is logged?

Answer 1

My first problem is I didn't have Suricata IPS, first delete ur iptables rules with

sudo iptables -F

sudo iptables -I INPUT -j NFQUEUE 
sudo iptables -I OUTPUT -j NFQUEUE 
sudo iptables -I FORWARD -j NFQUEUE

and execute the Suricata with -D to let as bg

sudo Suricata -q 0 -D