"
Hi - I am having the exact same problem (OPNSense 26.7.3_8).
I have IPS enabled with the single opnsense.test.rules enabled. By default this is set to block.
I test this works (and it does) by visting http://pkg.opnsense.org/test/eicar.com.txt
This is confirmed in the 'alerts' tab which shows the site was blocked.
Now I want to enable a policy to change rules from alert to block, before I go ahead and add more rules.
To do this I first manually change the test.rules from 'block' to 'alert'. Re-testing this works, and I can now access the eicar site.
Then I enable a policy as follows:
Enabled: Ticked
Priority: 0
Rulesets: Nothing Select (i.e., this applies to all rules)
Action: Alert
Rules: bad-unknown (only one available with just the test rule installed)
New action: Drop
I apply this, and then re-download and apply the rules for good measure.
Having done this, I now expect the policy to convert the 'alert' to 'drop' for my one rule. However I continue to see this working as 'alert' only, meaning the policy does not seem to be having any affect.
I'm keen to work this out so if anyone has any clues (or can just confirm that you have a policy which works) any help would be appreciated. Thanks
I have IPS enabled with the single opnsense.test.rules enabled. By default this is set to block.
I test this works (and it does) by visting http://pkg.opnsense.org/test/eicar.com.txt
This is confirmed in the 'alerts' tab which shows the site was blocked.
Now I want to enable a policy to change rules from alert to block, before I go ahead and add more rules.
To do this I first manually change the test.rules from 'block' to 'alert'. Re-testing this works, and I can now access the eicar site.
Then I enable a policy as follows:
Enabled: Ticked
Priority: 0
Rulesets: Nothing Select (i.e., this applies to all rules)
Action: Alert
Rules: bad-unknown (only one available with just the test rule installed)
New action: Drop
I apply this, and then re-download and apply the rules for good measure.
Having done this, I now expect the policy to convert the 'alert' to 'drop' for my one rule. However I continue to see this working as 'alert' only, meaning the policy does not seem to be having any affect.
I'm keen to work this out so if anyone has any clues (or can just confirm that you have a policy which works) any help would be appreciated. Thanks
