The most likely reason for the blocking to continue even after the rule is suppressed or disabled is that you had two instances of Snort running on the same interface, but one is in a sort of zombie state and does not see changes made within the GUI. That process would continue with the original rules in place. Rebooting the firewall will of course kill everything and start from scratch. There should be only a single Snort process running on each configured interface. You can check that using this command line:
ps -ax | grep snort
Sometimes multiple copies of Snort can happen if something causes the firewall to issue a "restart all packages" command while another Snort restart is already in progress (such as a rule update download). Another way to get multiple Snort copies running on the same interface is using the Service Watchdog package. Never use that package with either Snort or Suricata!. It does not understand how to properly start Snort and Suricata, nor does it know how to properly monitor all the configured interfaces. It will see Snort "down" during the restart from a rules update and thus issue its own "start up" command without knowing that Snort is already restarting. Thus you can wind up with two Snort instances running on the same interface, but only one of them will respond to GUI changes.
Bill
