Messages

1

Intrusion Detection and Prevention / Re: Error with IPS activation

« on: August 28, 2024, 07:24:59 pm »

Deactivating HW offload and rebooting breaks the connectivity to internet and UI. I needed to login physically to firewall and stop the suricata service in order to access the UI again.

2

Intrusion Detection and Prevention / Error with IPS activation

« on: August 27, 2024, 12:54:46 am »

Hello community,

I run opnsense [24.7.2] on Protectli Vault Pro VP2420 + zenarmor and have a very strange issue when I activate suricata IPS. Once activated it runs for a few seconds and then service crashes with the error below. IDS works fine, this happens only when I activate IPS mode.

Code: [Select]

Error suricata [104135] <Error> -- opening devname netmap:igc1-0/R@conf:host-rings=4 failed: Device busy
What I did so far to troubleshoot was to disable all hardware offloading incl. CRC, TSO & LRO but that only broke the connectivity and access to UI and internet was gone.

The interfaces I want to active IPS on are VLAN interfaces and physical WAN interface.

Any help with getting this work is appreciated!

Thanks,
N