I am using OPNsense 26.1.8_5 (the latest currently) and have turned on Intrusion Detection (Suricata). One of my network users wants to use Dropbox. Great! Their computer already has a static IP for other reasons, so I want to create a rule that allows Dropbox access, but only on her machine.
So far, I have found ways to:
- Enable Dropbox for everyone on the network by disabling the check - I don't want to let everyone do this
- Completely turn off ALL rule checking on her machine - Not ideal as it's a Windows computer and I am afraid of viruses
So, what I really want to do is disable Dropbox from checking her destination IP (which is static). I have not been able to find a way to do this, and while a policy editor is quite fancy, it seems to be missing an option to select a few rules and a Destination IP and convert a Drop to an Alert.
Is this just not possible or am I not looking at the right place?
Thanks.
The GUI cannot do it, but you can create a custom rule https://docs.opnsense.org/manual/ips.html#advanced-configuration
And bypass the Dropbox SID for the specific ip. I am not exactly sure on the correct syntax.
Quote from: sopex on May 27, 2026, 07:57:09 PMThe GUI cannot do it, but you can create a custom rule https://docs.opnsense.org/manual/ips.html#advanced-configuration slope (https://slopeio.org/)
And bypass the Dropbox SID for the specific ip. I am not exactly sure on the correct syntax.
Thanks for pointing me in the right direction. I have one question, though: when you mention bypassing the Dropbox SID for a specific IP using a custom rule, are you referring to creating a `pass` rule in Suricata's advanced configuration?