OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Profile of tcmax »
  • Show Posts »
  • Topics
  • Profile Info
    • Summary
    • Show Stats
    • Show Posts...
      • Messages
      • Topics
      • Attachments

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

  • Messages
  • Topics
  • Attachments

Topics - tcmax

Pages: [1]
1
17.1 Legacy Series / Suricata:User defined Rule (GeopIP Blocking) not working
« on: April 29, 2017, 10:51:38 am »
Hello,


OPNSense 17.1.5 up went through without problems, but now in the the logs i find mit (previous working)
rule GeoIP blocking being allowed instead of dropped.
I checked the settings, but verything seems to be ok.
IPS disabled, user defindes rule with a bunch of countries and default action "dropped".
I restartet the servie serveral times, reboot the whole machine, disabled / enabled the rule - no effect.
In the logs i read e.g. Rule Geoip blocking Dest: 123.207.241.38 (china, of course) an action: allowed
Why?
Any idea?

P.S: When IPS enabled, it changes to "blocked" - so far so good, but in the previous opnsense version IPS disabled still
uses my user defined rule, without using e.g. ET rules. Now opnsense seems to use my rule only, when ips enabled.
Disadvantage: IPS enabled hits my performance - throughput drops from 11,5 mb/sec to max 7.6 ...

Pages: [1]
OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2