Suricata rule to allow ntp from specific URL

Question

Is there a way to allow only port UDP 123(NTP) from certain domain eg time.aws.com ? Currently I am using this rule - pass ntp $HOME_NET any → $EXTERNAL_NET 123 (sid:4001; rev:1;) but wanted to tie it down to specific URL

I want to use time.aws.com on NTP as allowed domain

Answer 1

This should work:

drop ntp $HOME_NET any → $EXTERNAL_NET 123 (msg:"Message"; content:!"time.aws.com";sid:4001; rev:1;)

According to suricata documentation, you can negate that content, meaning any content that is not the one specified will be dropped.