Policy Suricata not working

[yeraycito]

Opnsense 21.1

[yeraycito]

Clean install Opnsense. Rules: ET Telemetry

[yeraycito]

Nothing works. In the Rulesets section which states that if nothing is selected it applies to everything does not work. And if you select everything it doesn't work either. There is no way to select the rules in blocking. It worked so well before blocking the categories of rules in the Download section, why do you change it?

[mimugmail]

Do you have the Checkbox for IPS enabled?

[yeraycito]

Yes. If I activate the lock setting in the Policy tab according to the following screenshot it does not work.

[yeraycito]

I just tried another test with a different configuration and it still doesn't work.

[yeraycito]

More screens

[yeraycito]

One last test with another configuration. It still does not work. The rule shown in the image as DROP is manually activated.

[yeraycito]

More screens

[yeraycito]

Last image

[Fright]

can you set description to your policy and then go to "Rules" and filter rules with matched_policy\"your_policy"?

[amichel]

Same here,
since the upgrade I see that the rules allow traffic instead of dropping it. I am using the same config as in 20.7 by implementing the "imported legacy import filter" Still no drops.
Maybe there is some configuration to be changed in the policy but the official documentation is not very helpful to be honest.
Is there a how to guide how to enable suricata so it drops packets by implementing the policies?

Filtering as per Policy shows nothing

[amichel]

I went back to the original config before the upgrade.
Now with the legacy rule untouched I see the rules are configured to block traffic

[Fright]

it seems that it may not be related to policies. also stopped blocking traffic on the test VM. deleted policies - not helped. turned off and on the checkboxes on the Settings tab (enabled, IPS, promisc) applying after each checkbox. IPS starts working after that.
may be some .yaml issue after update?

already completely blocked access to any remote management by including everything in the new policy and specifying the drop action  8)
play carefully with policies  ;D

[logandzwon]

Yes, agreed. It's totally unclear on how it is supposed to work. It worked so well before the update too.