IPS/Suricata does not drop anything via policy (opnsense.test.rules)

[MojoMC]

Hello everyone,

I am currently using OPNsense to separate a test network from our intranet.
At the moment, I am struggling with the successful configuration of IDS/IPS/Suricata. Specifically, it fails the test with Eicar in the unencrypted version, i.e., HTTP.

My configuration for IDS/IPS/Suricata is as follows:

•     Enabled √
•     IPS mode √
•     active on both Interfaces, LAN & WAN
•     WAN and LAN are included in "home networks"

In Intrusion Detection/Administration/Downloads the rule "OPNsense-App-detect/test" is enabled and downloaded. No other rules are enabled or even downloaded.
In Intrusion Detection/Administration/Rules, opnsense.test.rules is also enabled with the default action "Alert".
A policy for this rule valid for the actions/conditions "Alert" & 'Drop' resulting in the new action "Drop" has been created and applied.

If I run "curl http://pkg.opnsense.org/test/eicar.com.txt" from the test network, it goes through without any problems and I see it under the alerts, unfortunately with "Action: Allowed" – despite the active policy that should turn 'Alert' into "Drop."

If I manually change the test rule to "Drop," it is immediately dropped. I can't figure out why the policy isn't working.

Have I taken a wrong turn somewhere, am I overlooking something?

Thank you very much for any food for thought.

[MojoMC]

No ideas? No one else ever experienced this, too?

[RamSense]

to be sure: After you changed the hit from allow to drop, you have to go to [intrusion detection - administration - rules] and hit [Apply]
have you done that?

[MojoMC]

Do you mean after I changed the rule from "Alert" to Drop"? Yes, I did hit apply and the dropping worked fine.

Or do you want to suggest that after applying a policy in Intrusion Detection/Policy (including hitting the "Apply"-Button there) one has to go to Intrusion Detection/Administration/Rules and hit "Apply" there, too? Although no rule, only a policy, was changed?

[unholyeyebrows]

Hi - I am having the exact same problem (OPNSense 26.7.3_8).

I have IPS enabled with the single opnsense.test.rules enabled. By default this is set to block.

I test this works (and it does) by visting http://pkg.opnsense.org/test/eicar.com.txt
This is confirmed in the 'alerts' tab which shows the site was blocked.

Now I want to enable a policy to change rules from alert to block, before I go ahead and add more rules.

To do this I first manually change the test.rules from 'block' to 'alert'. Re-testing this works, and I can now access the eicar site.

Then I enable a policy as follows:

Enabled: Ticked
Priority: 0
Rulesets: Nothing Select (i.e., this applies to all rules)
Action: Alert
Rules: bad-unknown (only one available with just the test rule installed)
New action: Drop

I apply this, and then re-download and apply the rules for good measure.

Having done this, I now expect the policy to convert the 'alert' to 'drop' for my one rule. However I continue to see this working as 'alert' only, meaning the policy does not seem to be having any affect.

I'm keen to work this out so if anyone has any clues (or can just confirm that you have a policy which works) any help would be appreciated. Thanks