Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort not working for me (again)

    Scheduled Pinned Locked Moved pfSense Packages
    30 Posts 4 Posters 9.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      PC_Arcade
      last edited by

      @submicron:

      Any chance you're trying to run snort on multiple interfaces?

      None whatsoever :(

      Weird, I'll stop using it again then.

      1 Reply Last reply Reply Quote 0
      • P
        PC_Arcade
        last edited by

        Probably, however what I don't understand is how it's picking up an incorrect setting in the first place

        I'll try your suggestion later

        1 Reply Last reply Reply Quote 0
        • P
          PC_Arcade
          last edited by

          OK, this is the line in my snort.conf :

          var HOME_NET [192.168.1.0/24,/32,86.3.142.145,192.168.1.2,,]

          however if I remove the ,/32, the file gets recreated when I save snort config and overwrites any changes I make :(

          any ideas?

          I can post the entire snort.conf file and the startup logs if it helps?

          There is another warning in the snort starup log though :
          snort[13576]: WARNING /usr/local/etc/snort/snort.conf(36) => flush_behavior set in config file, using old static flushpoints (0)

          Does that shed any light?

          1 Reply Last reply Reply Quote 0
          • Y
            yoda715
            last edited by

            Do you remember if you recently updated your snort rules before you started having troubles?

            1 Reply Last reply Reply Quote 0
            • P
              PC_Arcade
              last edited by

              The rules were updated, BUT so was my entire machine, I changed to the 19th's image (cos of the lovely new look gui!) and reinstalled from scratch, everything was upgraded

              1 Reply Last reply Reply Quote 0
              • Y
                yoda715
                last edited by

                I'm not sure why, but I have problems starting snort when I have web-misc category checked. If you have that ruleset enabled, try disabling it and see if Snort will start up.

                1 Reply Last reply Reply Quote 0
                • P
                  PC_Arcade
                  last edited by

                  Not ticked, could this thread shed any light (or at least point to the fact that there's something odd going on with the HOME_NET line?) : http://forum.pfsense.org/index.php/topic,3427.0.html

                  1 Reply Last reply Reply Quote 0
                  • S
                    sullrich
                    last edited by

                    @PC_Arcade:

                    Not ticked, could this thread shed any light (or at least point to the fact that there's something odd going on with the HOME_NET line?) : http://forum.pfsense.org/index.php/topic,3427.0.html

                    No, because that has already been fixed.

                    1 Reply Last reply Reply Quote 0
                    • P
                      PC_Arcade
                      last edited by

                      Has it?? What snapshot was it fixed in?

                      1 Reply Last reply Reply Quote 0
                      • S
                        sullrich
                        last edited by

                        @PC_Arcade:

                        Has it?? What snapshot was it fixed in?

                        Those files do not reside in a snapshot.  They are on the server… Its a package file, not a base file.

                        1 Reply Last reply Reply Quote 0
                        • P
                          PC_Arcade
                          last edited by

                          OK, found and fixed the problem.

                          If you have a wireless connection (opt1) bridged with LAN and you leave the IP address blank in the IP configuration box on the opt1 interface it causes the problems I was having.

                          You have to un-bridge the connection put a (fake?) ip address in and then re-bridge the connection.

                          That seems to fix it, although I need to give it a proper test

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.