Messages

Thanks for confirming my understanding. Not sure why it doesn't appear to be working for me but I'm new to this so I'll do some more reading. If I work it out I'll post back the answer here.

How do you visit this? Maybe your browser redirects you instantly to https:// and thus you can access it.

Try using curl and force http only.

I'm just using the browser but have forced it to http rather than https and confirm it does not re-direct from http to https. Understood that with https the encryption means IPS cannot see the payload.

I guess my question is, should I be able to adjust the way rules are applied using the policy setting, or have I mis-understood how it works?

Hi - I am having the exact same problem (OPNSense 26.7.3_8).

I have IPS enabled with the single opnsense.test.rules enabled. By default this is set to block.

I test this works (and it does) by visting http://pkg.opnsense.org/test/eicar.com.txt
This is confirmed in the 'alerts' tab which shows the site was blocked.

Now I want to enable a policy to change rules from alert to block, before I go ahead and add more rules.

To do this I first manually change the test.rules from 'block' to 'alert'. Re-testing this works, and I can now access the eicar site.

Then I enable a policy as follows:

Enabled: Ticked
Priority: 0
Rulesets: Nothing Select (i.e., this applies to all rules)
Action: Alert
Rules: bad-unknown (only one available with just the test rule installed)
New action: Drop

I apply this, and then re-download and apply the rules for good measure.

Having done this, I now expect the policy to convert the 'alert' to 'drop' for my one rule. However I continue to see this working as 'alert' only, meaning the policy does not seem to be having any affect.

I'm keen to work this out so if anyone has any clues (or can just confirm that you have a policy which works) any help would be appreciated. Thanks