IPS/Suricata does not drop anything via policy (opnsense.test.rules)

[MojoMC]

Hello everyone,

I am currently using OPNsense to separate a test network from our intranet.
At the moment, I am struggling with the successful configuration of IDS/IPS/Suricata. Specifically, it fails the test with Eicar in the unencrypted version, i.e., HTTP.

My configuration for IDS/IPS/Suricata is as follows:

•     Enabled √
•     IPS mode √
•     active on both Interfaces, LAN & WAN
•     WAN and LAN are included in "home networks"

In Intrusion Detection/Administration/Downloads the rule "OPNsense-App-detect/test" is enabled and downloaded. No other rules are enabled or even downloaded.
In Intrusion Detection/Administration/Rules, opnsense.test.rules is also enabled with the default action "Alert".
A policy for this rule valid for the actions/conditions "Alert" & 'Drop' resulting in the new action "Drop" has been created and applied.

If I run "curl http://pkg.opnsense.org/test/eicar.com.txt" from the test network, it goes through without any problems and I see it under the alerts, unfortunately with "Action: Allowed" – despite the active policy that should turn 'Alert' into "Drop."

If I manually change the test rule to "Drop," it is immediately dropped. I can't figure out why the policy isn't working.

Have I taken a wrong turn somewhere, am I overlooking something?

Thank you very much for any food for thought.

[MojoMC]

No ideas? No one else ever experienced this, too?

[RamSense]

to be sure: After you changed the hit from allow to drop, you have to go to [intrusion detection - administration - rules] and hit [Apply]
have you done that?

[MojoMC]

Do you mean after I changed the rule from "Alert" to Drop"? Yes, I did hit apply and the dropping worked fine.

Or do you want to suggest that after applying a policy in Intrusion Detection/Policy (including hitting the "Apply"-Button there) one has to go to Intrusion Detection/Administration/Rules and hit "Apply" there, too? Although no rule, only a policy, was changed?

[unholyeyebrows]

Hi - I am having the exact same problem (OPNSense 26.7.3_8).

I have IPS enabled with the single opnsense.test.rules enabled. By default this is set to block.

I test this works (and it does) by visting http://pkg.opnsense.org/test/eicar.com.txt
This is confirmed in the 'alerts' tab which shows the site was blocked.

Now I want to enable a policy to change rules from alert to block, before I go ahead and add more rules.

To do this I first manually change the test.rules from 'block' to 'alert'. Re-testing this works, and I can now access the eicar site.

Then I enable a policy as follows:

Enabled: Ticked
Priority: 0
Rulesets: Nothing Select (i.e., this applies to all rules)
Action: Alert
Rules: bad-unknown (only one available with just the test rule installed)
New action: Drop

I apply this, and then re-download and apply the rules for good measure.

Having done this, I now expect the policy to convert the 'alert' to 'drop' for my one rule. However I continue to see this working as 'alert' only, meaning the policy does not seem to be having any affect.

I'm keen to work this out so if anyone has any clues (or can just confirm that you have a policy which works) any help would be appreciated. Thanks

[Monviech (Cedrik)]

How do you visit this? Maybe your browser redirects you instantly to https:// and thus you can access it.

Try using curl and force http only.

[unholyeyebrows]

How do you visit this? Maybe your browser redirects you instantly to https:// and thus you can access it.

Try using curl and force http only.

I'm just using the browser but have forced it to http rather than https and confirm it does not re-direct from http to https. Understood that with https the encryption means IPS cannot see the payload.

I guess my question is, should I be able to adjust the way rules are applied using the policy setting, or have I mis-understood how it works?

[Monviech (Cedrik)]

No you haven't misunderstood it, when you change the policy to drop it should prevent you from downloading the file and log that.

[unholyeyebrows]

Thanks for confirming my understanding. Not sure why it doesn't appear to be working for me but I'm new to this so I'll do some more reading. If I work it out I'll post back the answer here.

[collinsl]

Afraid I'm seeing this too on 26.7.3_8 - I've got lots of rules enabled and a policy should be converting alert to drop, however I'm seeing all alerts as "allowed" in the list of alerts.

Please let me know if you need any more info for diagnosis, happy to assist with troubleshooting outside of my working hours.