Updating SNORT Rules results in network disconnect

ong1234

PFsense Version: 2.7.2-RELEASE (amd64) built on Thu Dec 7 4:10:00 +08 2023
Snort Version: 4.1.6_17 (latest as there were no updates available)

I have been running Pfsense and it is very stable - no (or very little) issues with network disconnect or anything. However it seems that whenever I attempt to update Snort rules, there will be a short network disconnect. Sometime when I apply drop for the Snort rules, there will also be a short network disconnect. Tested with ping test and for a few seconds, it would disconnect.

I had checked the system logs and it seems like there is this:

/rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - X -> X - Restarting packages.

The IP address on the system log is the same (X->X), so there was actually no IP change. My WAN IP address is also a static IP address and I have not changed the IP address.

Rules enabled:
Snort GPLv2 Community Rules (Talos certified)
Feodo Tracker Botnet C2 IP Rules
emerging-compromised.rules
emerging-current_events.rules

Anyone faced the same issue before?
Any help would greatly be appreciated.

SteveITS

@ong1234 There’s an option in Suricata to live reload rules…pretty sure it’s in Snort too. Otherwise it restarts the process which has that symptom.

ong1234

Tried checking Snort global settings but can't find the option.
Seems that the entire network drops everytime I do an update for the snort rules.

And I wonder why it detect a change in the WAN IP address.

Also to add this is a new pfsense setup (new N100 device). The previous setup had this issue as well.

SteveITS

@ong1234 On Suricata it's on Global Settings, Live Rule Swap on Update:

"Enable "Live Swap" reload of rules after downloading an update. Default is Not Checked
When enabled, Suricata will perform a live load of the new rules following an update instead of a hard restart. If issues are encountered with live load, uncheck this option to perform a hard restart of all Suricata instances following an update."

We don't have any Snort to look, anymore...a combination of 1) Snort being problematic on 3100s/32 bit ARM, so we standardized on Suricata, and 2) the package maintainer has indicated a few times on this forum that he won't be developing a Snort 3 package, so it will basically die off with Snort 2 EOL.

re: change in the WAN IP address, I think that is a default message when an interface restarts in pfSense. More like, "I found an IP address and this is it."

bmeeks

Snort does not have a "soft rule reload" option because of the way it handles pre-processors. They cannot be reliably "soft loaded/restarted" and could cause a rule reload to fail. Therefore, in Snort, rule updates will restart the Snort process at the end.

If you are using Inline IPS Mode, the netmap kernel device used with that mode of operation will restart the pfSense interface each time the Snort process restarts. There is no way to avoid that.

Legacy Blocking Mode formerly did not restart the interface when the Snort process restarted, but about two or three years ago anecdotal evidence reported by users suggests that even that mode can now result in interface restarts when the Snort process closes and then opens a PCAP session link to the interface. Perhaps something changed within libpcap on FreeBSD ???

So, the TLDR answer is that an interface restart is expected when Snort restarts.

JonathanLee

Snort when it updates is very memory needy, you need to set it to update in the night and it enable a swap

ong1234

@bmeeks I understand now. Tk u

ong1234

@JonathanLee Good idea. Thank you will do it this way.