Suricata Issue - 26.7.7

[spetrillo]

Hello all,

I have built a bare metal Lenovo M720q Tiny into an OPNsense firewall. The Lenovo unit has 8 gig of RAM, a 128 gig NVMe drive, and a dual port Intel E610 10 gig card in the PCIe slot. I am running 26.7.7 currently but the problem I am facing has been happening since I built the unit. I have Suricata configured to use the network driver names(ix0/ix1) instead of the VLAN interface names. It is configured to use Netmap with Hyperscan. When I enable Suricata it takes about 20-30 seconds before the firewall hangs. I literally have to turn it off and back on, and then disable Suricata to keep the firewall operational.

Has anyone run into this problem? I am completely baffled by this bc if I configure Suricata to use the VLAN interface names the firewall stays operational. All the documentation I have read is when the firewall is bare metal you should use the physical driver names instead. Is this still correct?

Thanks,
Steve

[yeraycito]

This week, I've been testing Suricata configured on the WAN interface as an IPS using Hyperscan, and I'm experiencing the same issue. Sometimes, OPNsense freezes completely—requiring a power cycle—about an hour after enabling Suricata; on other occasions, it has managed to stay up for up to three hours, but no longer than that. There are no errors recorded in either the OPNsense logs or the Suricata logs.

[spetrillo]

Are you configured for the actual network device name or the interface name?

I found nothing in my logs either.