Switch from IDS to IPS

[FyreWall]

Currently running in IDS mode.
If I switch to IPS mode, how do I change all the rules from Alert to Drop? Is there a way to change them all at once?

Thanks for any guidance

[BoNetTech]

Yes, there is a way to change them all at once, and the recommended way is a policy, not per-rule changes.

1. Policy (Services > Intrusion Detection > Administration > Policy tab)
– Add a policy, select the rulesets you want to act on (e.g. the ET ones you use), and set Action = Drop (and "New action" = Drop if your version asks for it).
– Policies are applied on top of the rules and survive ruleset updates, so you don't have to touch every rule.
– You can narrow it down by rule metadata (e.g. only "emerging-malware"), which is a good way to start with a small group of rules instead of everything.

2. Rules tab (alternative)
– In the Rules tab you can filter the list, select all the filtered rows with the checkbox in the header and use the buttons for the selected rules (Alert/Drop, if your version has them). This works for one-off changes, but a policy is easier to maintain.

3. Before enabling IPS mode
– IPS mode needs a network card driver that supports netmap. Disable hardware offloading (CRC, TSO, LRO) in Interfaces > Settings.
– Set IPS mode on the physical interface, not on a VLAN (check the docs: docs.opnsense.org/manual/ips.html).
– Don't switch all rules to Drop on day one: a dropped legitimate connection is hard to diagnose. Start with a few rule categories, watch the Alerts tab for a few days and widen later. Keep a config backup so you can go back.

Sergio