snort.sh

#!/bin/bash                                                                                                                                    
                                                                                                                                               
SNORT_PIDFILE=/var/run/snort.pid                                                                                                               
                                                                                                                                               
snort_start(){                                                                                                                                 
                                                                                                                                               
    iptables -A FORWARD -i eth0 -o eth1 -j NFQUEUE                                                                                             
    iptables -A FORWARD -i eth1 -o eth0 -j NFQUEUE                                                                                             
                                                                                                                                               
    snort_root=/srv/snort                                                                                                                      
                                                                                                                                               
    [ -e "$snort_root" ]    || mkdir -p "$snort_root"                                                                                          
    [ -e "$snort_root/log" ]    || mkdir -p "$snort_root/log"                                                                                  
    [ -d "$snort_root/dev" ] || mkdir "$snort_root/dev"                                                                                        
    [ -e "$snort_root/dev/random" ]  || mknod -m 644 "$snort_root/dev/random" c 1 8                                                            
    [ -e "$snort_root/dev/urandom" ] || mknod -m 644 "$snort_root/dev/urandom"  c 1 9                                                          
    [ -e "$snort_root/dev/null" ]    || mknod -m 777 "$snort_root/dev/null" c 1 3                                                              
                                                                                                                                               
    snort -qpQ --daq nfq --daq-mode inline  \                                                                                                  
        -u snort -g snort -t "$snort_root"  \                                                                                                  
        -l "$snort_root/log" -c /etc/snort/snort.conf
        
    echo $(pidof snort) > $SNORT_PIDFILE
}

snort_stop(){
    iptables -D FORWARD -i eth0 -o eth1 -j NFQUEUE
    iptables -D FORWARD -i eth1 -o eth0 -j NFQUEUE       
    [ "$(pidof snort)" ] && kill $(pidof snort)
    [ -e $SNORT_PIDFILE ] && rm $SNORT_PIDFILE
}

snort_restart(){
    snort_stop
    snort_start
}

case "$1" in
    'start')
      snort_start;;
    'stop')
      snort_stop;;
    'restart')
      snort_restart;;
    *)
      echo "Usage: $0 start|stop|restart";;
esac