rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Disable Modbus Suricata rules that fail to parse

Browse source 
Modbus protocol detection is disabled in the NixOS build; the 5 Modbus
SIDs (2250005-2250009) cause the config test to fail and crash-loop the
service. Disable them alongside the existing DNP3 exclusions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
ediblerope 2026-04-06 20:51:22 +01:00
parent b91b0ef234
commit d1ac7c6965
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
services/suricata.nix
View file

@ -5,6 +5,13 @@
services.suricata = { services.suricata = {
enable = true; enable = true;
# Default disabledRules covers DNP3 (2270000-2270004); add Modbus rules
# which also fail to parse because those protocols are disabled in the build
disabledRules = [
"2270000" "2270001" "2270002" "2270003" "2270004"
"2250005" "2250006" "2250007" "2250008" "2250009"
];
settings = { settings = {
vars.address-groups = { vars.address-groups = {
# Your local networks — Suricata won't alert on traffic within these # Your local networks — Suricata won't alert on traffic within these