IPS_Setup.sh

#!/bin/bash

# Snort IPS Setup Script
set -e

echo "Installing Docker, iptables, and iptables-persistent..."
sudo apt update
sudo apt install -y docker.io iptables iptables-persistent

echo "Enabling IP forwarding..."
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo sysctl -w net.ipv4.ip_forward=1
sudo bash -c 'echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf'
sudo sysctl -p

echo "Building Snort Docker image..."
docker build -t snort-ips .

echo "Starting Snort container with host network and privileged access..."
docker run -dit --name snort-ips --privileged --network host snort-ips

echo "Setting up iptables rules to send traffic to NFQUEUE..."
sudo iptables -I FORWARD -j NFQUEUE --queue-num 0
sudo iptables -I INPUT -j NFQUEUE --queue-num 0
sudo iptables -I OUTPUT -j NFQUEUE --queue-num 0

echo "Saving iptables rules for persistence..."
sudo iptables-save | sudo tee /etc/iptables/rules.v4

echo "Setup complete! Now attach to the container and start Snort:"