Suricata IDS not working with NordVPN connected

Question

I configured suricata.yaml file to detect intrusion in any interface and it works well without NordVPN.

When I test Suricata by visiting:

curl http://testmynids.org/uid/index.html

Result of sudo tail /var/log/suricata/fast.log | grep 2100498:

08/14/2023-22:28:35.580451  [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 64.12.213.57:80 -> 192.168.15.17:3354

However, when I connect to NordVPN (nordvpn connect us-ca55) the test traffic is not being detected.

Any ideas on how to properly set up the yaml config file? My intuition tells me it is just one or two lines of code, but I can't find where.

I used ip a to find the interfaces, tried 3 of them, also any but is not detecting the test traffic with the VPN connected.

I'm using Ubuntu 22.04.

Answer 1

I solved the problem. The problem was at ports used by NordVPN and interface.

These lines of code in suricata.yaml solved the problem:

port-groups:

FILE_DATA_PORTS: "[$HTTP_PORTS,110,143,443,51820]"
TCP_PORTS: "[1723,1701]"
UDP_PORTS: "[500,4500,1194]"

interface: nordlynx