Snort_inline is a modified version of Snort. It accepts packets from iptables, instead of libpcap. It uses new rule types to tell iptables if the packet should be dropped or allowed to pass based on the Snort rules.

http://sourceforge.net/projects/snort-inline

有空一定要试试，看似不错的东西，不用自己去和防火墙联动了