@beemks thank you very much issue is resolved , bymistake I added an extra space in Oinkcode . Mark this thread as solved

Regards

I've added an entry to my internal bug tracking list to check for and trim off any extraneous spaces on the Oinkcode or ET-Pro code before storing them in the configuration. I'll put that in the next update for Snort. Neither of those codes should have spaces in them, but it's easy for one to slip in unnoticed since you can't see it on the screen.

@scorpoin said in snort faield to up date rules:

thanks for respoinse , I'm also using pfblockerng is this a case where it might be blocked? can any one share me the update url so I will add it into white-list in pfblocker-ng . I'm using free subscription for now.

Regards

Yes, there have been reported instances in the past where the AWS IP space used by the Snort rules update process has gotten on an IP list that users may enable in pfBlockerNG.

This is the base URL: https://www.snort.org/rules/. Your Oinkcode is added to the end as a query string.

I'll repeat my troubleshooting advice one more time here for all to see. ANYTIME you are getting failures of downloads or similar issues and you are running Snort, Suricata or pfBlockerNG you should immediately suspect one of those as the potential cause and starting disabling them in some sequence to find the culprit. In this case, since Snort nor Suricata is likely to block their own downloads, I would have suspected pfBlockerNG and disabled it first to see if the rules update succeeds. If it does, then you have found your problem and can then look for a solution.

@beemks thank you very much issue is resolved , bymistake I added an extra space in Oinkcode . Mark this thread as solved

Regards

thanks for respoinse , I'm also using pfblockerng is this a case where it might be blocked? can any one share me the update url so I will add it into white-list in pfblocker-ng . I'm using free subscription for now.

Regards

Yes, there have been reported instances in the past where the AWS IP space used by the Snort rules update process has gotten on an IP list that users may enable in pfBlockerNG.

This is the base URL: https://www.snort.org/rules/. Your Oinkcode is added to the end as a query string.

I'll repeat my troubleshooting advice one more time here for all to see. ANYTIME you are getting failures of downloads or similar issues and you are running Snort, Suricata or pfBlockerNG you should immediately suspect one of those as the potential cause and starting disabling them in some sequence to find the culprit. In this case, since Snort nor Suricata is likely to block their own downloads, I would have suspected pfBlockerNG and disabled it first to see if the rules update succeeds. If it does, then you have found your problem and can then look for a solution.

Regards

You might also just need to wait a bit and try again. Snort rules are hosted on AWS infrastructure, and depending on where you are in the world you may be hitting a different physical server than @NogBadTheBad or I would. You have the latest version of the Snort package, so don't worry about an update. You either have something wrong with your Oinkcode or the server you are getting directed to for rules download has a temporary issue.

You have got a valid Oinkmaster Code ?

Services -> Snort -> Global Settings -> Snort Subscriber Rules

https://forum.netgate.com/topic/71578/pfsense-snort-vrt-subsciption-error-505-solved