Am I missing something?

[Mystique_]

Google says this is a common settings issue.. but I can't figure out why it's not blocking..

According to the blocks they are set to Alert.. According to the settings title: "block on drop only" description says it also blocks on alert, but I see nothing in Blocks.. If I manually change the rule to drop, it will drop and add to blocks, but I thought that's what the override in settings was supposed to do..

https://imgur.com/a/D6ex23f

(screen shots of suricata settings, snort rules, enabled and updated. ETOpen ET rules, Snort Free, Snort GPLv2, and "hide depreciated categories" )

bce dual nic.. 2.5.0 development version

bce1 is wan
bce0 is tagged for vlan 10, 20, 30, 172

only running suricata on bce1 (wan)

hardware checksum - disabled
hardware tso offload - disabled
hardware lro offload - disabled

inline does not enable, so sticking with legacy..

Thanks in advance for any suggestions.

[kiokoman]

@mystique_
Checking this option will insert blocks only when rule signatures having the DROP action are triggered. When not checked, any rule action (ALERT or DROP) will generate a block of the offending host. Default is Not Checked.

checked = only drop
not checked = alert and drop

[Mystique_]

Thank you for that.

There must be someway to make that description clearer.

After removing the check, I didn’t immediately see blocked hosts, but after restarting suricata, I now have blocked hosts.

Greatly appreciate your response.