Messages

The automatically generated rule <virusprot> seems to block internal IP's from going to the WAN when a threshold of connections is reached for the internal IP address.

In my case this happened when a server wanted to get update packages and triggered the threshold apparently.

But I have no clue where I can unblock this specific client nor where i can increase the rules that contain the trigger values.
Any manually created rule is inserted after the automatically created rules so will never overrule the automatics.

OPNsense 25.7.1_1-amd64
FreeBSD 14.3-RELEASE-p1

https://rules.emergingthreatspro.com/open/suricata-5.0/
Suricata seems to have updated their rules set to detect this.

It is possible to detect and block the log4j hacking attempts with the OPNSense firewall (or other parts) rules?
I know other firewalls already have rules available to detect and block possible attempts, like https://cloud.google.com/blog/products/identity-security/cloud-armor-waf-rule-to-help-address-apache-log4j-vulnerability