Trying to navigate to Active Rules for an interface yields a blank (white) page.

I have a Netgate 4200 MAX, 26.03-RELEASE (amd64).

In Global Settings I have Snort VRT with code, Enable ET Open, Enable OpenAppID + Text Rules, Enable FEODO Tracker Botnet C2 IP Rules

Services / Snort Interface Settings / PORT1WAN - Categories

• Resolve Flowbits
• Use IPS Policy : Security
  Mode : Policy

Services / Snort Interface Settings / PORT1WAN - Rules

• Trying to view the Available Rule Categories, selecting Active Rules causes a momentary spin, then a blank page.

Then on the dashboard there is an error report link:

Crash report begins.  Anonymous machine information:

amd64
16.0-CURRENT
FreeBSD 16.0-CURRENT #36 plus-RELENG_26_03-n256531-4923e82e59d1: Fri Mar 20 18:22:49 UTC 2026     root@pfsense-build-release-amd64-1.eng.atx.netgate.com:/var/jenkins/workspace/pfSense-Plus-snapshots-26_03-main/obj/amd64/TVcqnR7U/var/jenkins/workspace/pfSe

Crash report details:

PHP Errors:
[09-May-2026 11:35:01 US/Central] PHP Fatal error:  preg_replace(): Cannot use output buffering in output buffering display handlers in /usr/local/www/csrf/csrf-magic.php on line 163
Stack trace:
#0 /usr/local/www/csrf/csrf-magic.php(163): preg_replace()
#1 [internal function]: csrf_ob_handler()
#2 {main}

No FreeBSD crash data found.

I'm curious if enabling this impacts more VLANs or if it just impacts the selected VLAN I have Snort running on in this environment.

Any ideas?

On an additional note, does this change require a reboot or anything along those lines?

We have a /24 real IPs network behind pfSense, Suricata and pfBlockerNG (pfSense 2.8.1, Suricata 7.0.8_5). I'm looking for a way to combine the best features of both Legacy and Inline IPS modes. I.e. how to block offending IP totally for a good measure of time (3-6 hours) totally if the rule was activated and packet dropped? We switched from "Legacy" to "Inline" mode, and immediately our logs were full of single-type messages, along with attempts to brute-force attack SSH ports on our servers. From the same IP address, over 2,000 were reached in just 10 hours. It really messes up the log files. The best thing to do would be to use something like fail2ban in Linux. This would allow you to allow two to five attempts in two minutes, and then a total ban for 6 to 12 hours for the same IP address.

Cannot seem to find the logs that shows what the issue is.

Services Suricata Global Settings
ETOpen is a free open source set of Suricata rules whose coverage is more limited than ETPro. - Checked
Use a custom URL for ETOpen downloads - Checked
Install Feodo Tracker Botnet C2 IP rules - Checked
Install ABUSE.ch SSL Blacklist rules - Checked

ETOpen Custom Rule Download URL
https://rules.emergingthreats.net/open/suricata-7.0.8/emerging.rules.tar.gz

Services Suricata LAN - Interface Settings
Interface LAN
Alert and Block Settings - Unchecked (doing IDS-only atm)

Services Suricata Interface Settings LAN - Categories

ONLY Feodo Tracker Botnet C2 IP Rules is checked

AMD Ryzen 5 5600G with Radeon Graphics
12 CPUs : 1 package(s) x 6 core(s) x 2 hardware threads
AES-NI CPU Crypto: Yes (active)
QAT Crypto: No
Memory 16GB memory
Ethernet Controller 10-Gigabit X540-AT2

Hardware Checksum Offloading - Unchecked
Hardware TCP Segmentation Offloading - Unchecked
Hardware Large Receive Offloading - Unchecked
hn ALTQ support - Checked

I did leave it for 10 mins but the network was still down, not sure what i am doing wrong.

I am attempting to incorporate Wazuh into my network security. The Wazuh site states

"There are several ways to integrate pfSense with Wazuh. The easiest method is syslog, but you can also use the Wazuh agent. Wazuh agent (native package for pfSense) is already pre-installed In pfSense which is available in Yandex Cloud Marketplace/VK Cloud Marketplace. Therefore, you can start setting up immediately, bypassing the installation process."

I do not see one. It then explains how to use by configuring Suricata, and finally, it explains how to import the syslog itself. But all reference restarting the "Agent".

Several sites show how to 'fix' pfsense to get packages directly from FreeBSD repositories, but that seems to be fairly dangerous.

So does anyone have a reference on how to send syslogs from PfSense to Wazuh without "backdoor tinkering"?

Thanks

I have a Netgate 8200 running 24.11-RELEASE (amd64) with Suricata 7.0.8_5 package installed. Suricata doesn't seem to start. It loops to red once I press the Play button on the interface.
It leaves no logs in the System logs, it leaves no logs in suricata.log at

/var/log/suricata/suricata_ovpns933787/suricata.log

I tried launching it manually:

# /usr/local/bin/suricata -V

or

# /usr/local/bin/suricata -c  /usr/local/etc/suricata/suricata_33787_ovpns9/suricata.yaml -i suricata_ovpns933787

and I get this output

ld-elf.so.1: /usr/local/bin/suricata: Undefined symbol "__strlcpy_chk@FBSD_1.8"

Thanks in advance,
Dara