Firewall interaction with snort: unblocked a not blocked host



  • I can't connect to a certain ip, and my filterlog shows that the ip is being blocked.

    grepping the filter log (is this the right way of doing it?) I find three hits: 2x"(http_inspect) UNKNOWN METHOD" and 1x"(http_inspect) SIMPLE REQUEST".

    Then I find "@51(1000000118) block drop log quick from any to snort2c:1215label "Block snort2c hosts"" somewhere else (I forget where).

    But looking at the Snort blocklist, the ip is not shown. I increase the number of hosts shown until they are all shown - still nothing.

    I cleared the blocklist, and now I can connect - but where else in the gui should I go to see which hosts are blocked, aside from the "Services/Snort/Blocked Hosts"?  :-\

    Thanks.</snort2c:1215>



  • You can check in the Tables Tabs.
    Diagnostic -> Tables-> Select Snort2c from list.