OPNsense Forum

English Forums => Intrusion Detection and Prevention => Topic started by: jlficken on April 18, 2024, 02:19:37 AM

Title: Unchecking "Enabled" on a policy doesn't stop it from processing
Post by: jlficken on April 18, 2024, 02:19:37 AM
I just made the switch over from Untangle and I believe I found a bug as I made a "Default" policy to test with before making my real policies.

Once I had the real policies in place I just unchecked the "Enabled" checkbox and hit Apply.

It appears that I'm either doing something wrong, I need to restart the service, or there's a bug as the Alerts tab kept showing matches for this policy until I actually deleted it and hit Apply again.

Has anyone else experienced this?
Title: Re: Unchecking "Enabled" on a policy doesn't stop it from processing
Post by: blacklistme on May 07, 2024, 03:04:03 PM
same here!
I´m trying to costumize the ruleset with policies. But no matter what settings I use in the policy, it just have no effect on the alerts its generates. 

I would be very happy about a solution :)
Title: Re: Unchecking "Enabled" on a policy doesn't stop it from processing
Post by: albovell on May 09, 2024, 07:50:41 PM
For what it's worth, I've always had to click "Apply" in the "Rules" tab for any change I've done before it to take place, be it Enabling or Disabling some specific rule. I suppose the "Apply" kind of "drives" the actual changes into some memory or file. But that's what has worked for me for maybe years now. Good luck :)

- Aleksi

Quote from: blacklistme on May 07, 2024, 03:04:03 PM
same here!
I´m trying to costumize the ruleset with policies. But no matter what settings I use in the policy, it just have no effect on the alerts its generates. 

I would be very happy about a solution :)
Title: Re: Unchecking "Enabled" on a policy doesn't stop it from processing
Post by: rickygm on May 11, 2024, 08:12:11 AM
Quote from: blacklistme on May 07, 2024, 03:04:03 PM
same here!
I´m trying to costumize the ruleset with policies. But no matter what settings I use in the policy, it just have no effect on the alerts its generates. 

I would be very happy about a solution :)

This worked for me, but is this a bug or is it the correct procedure to deactivate a nasty rule?