(Solved) Snort 4.1.6_28 fatal error

fireodo

Hi,

since this morning I get an error and snort on the LAN interface stops working.
(I didnt change anything in Snort since months ...)

FATAL ERROR: /usr/local/etc/snort/snort_10499_igb0/rules/snort.rules(1586) Negated IP ranges that are more general than non-negated ranges are not allowed. Consider inverting the logic: [$EXTERNAL_NET,$HTTP_SERVERS].

Could that be (there was a Rules update) that in the rules is a faulty entry that causes that?

Edit (if someone stumble over this post) I found the culprit: in the ET Open Rules the "emerging-exploit.rules" has a faulty entry that causes Snort to stop on that interface and exiting with that "FATAL ERROR".

Thanks and regards,
fireodo

ESPNSTI

Specifically, it appears to be this rule:

2054074 - ET EXPLOIT Kingdee Cloud Star Deserialization Vulnerability

fireodo

@ESPNSTI said in Snort 4.1.6_28 fatal error:

Specifically, it appears to be this rule:

2054074 - ET EXPLOIT Kingdee Cloud Star Deserialization Vulnerability

Yeah - i guess it should be "[$HOME_NET,$HTTP_SERVERS]" instead of "[$EXTERNAL_NET,$HTTP_SERVERS]" - thanks for researching!

Its sad that 1 faulty rule can render useless a whole important category ...

Xquizet

@fireodo
The culprit: in the ET Open Rules the "emerging-exploit.rules" has a faulty entry that causes Snort to stop on that interface and exiting with that "FATAL ERROR".

This is what was causing the error for me as well, and unchecking the box for this allowed Snort to activate and start working again.

JonathanLee

https://forum.netgate.com/topic/200784/resolved-snort-and-suricata-service-startup-failures-on-et-rules-update There are two rules with issues

SID 2054074 Fix: Manually corrected the broken variable logic by changing the conflicting $EXTERNAL_NET reference to $HOME_NET, allowing the engine to mathematically resolve the network paths cleanly.

SID 2033776 Fix: Cleaned up the broken trailing regular expression string parameters to satisfy the Snort parser.Toggled the interface back on to complete the reload cycle.

or just disable those two rules and it will start

RKiFkRyCevGvpLeXMove

Here was my fix based on your info:

Services -> Snort
SID Mgmt -> Enable Automatic SID State Management -> Enable
Save
Add
List Name: fix_extnet
2054074 "EXTERNAL_NET" "HOME_NET"
Save
SID Management List Interface Assignments -> Modify SID List -> fix_extnet
Save

Then I tried starting snort from the pfsense dashboard, and it did not start. So I went back to Services -> Snort, Snort Interfaces -> Snort Status -> Start

Now it's back up and running.

Thanks for your help in finding the problem.

DBMandrake

@RKiFkRyCevGvpLeXMove
Thank you for this - worked perfectly!

fireodo

10.06.2026 Faulty rule was corrected by Emerging Threat maintainer!