Snort (pfSense 2.8.1 / package 4.1.6_28) – DNP3 rules not triggering while working in standalone Snort 2.9.20_8

[honeybadger101]

I’m currently testing Snort integration on pfSense 2.8.1-RELEASE using the Snort package version 4.1.6_28, which depends on Snort 2.9.20_8.
I’ve run into an issue where DNP3 rules are not triggering in pfSense, even though the exact same rules and PCAPs work correctly when I run Snort standalone.

What I tested (standalone Snort)

In a separate Ubuntu environment, I built Snort 2.9.20 from source, and configured the following:

• stream5 enabled
• dnp3 preprocessor enabled
• modbus preprocessor enabled
• custom local.rules

Example rule:

alert tcp any any -> any 20000 \
(msg:"OT DNP3 DIRECT OPERATE observed"; \
dnp3_func:direct_operate; \
sid:6100005; rev:1;)

Running command:

snort -r dnp3_cut.pcap -c snort.conf -A console -k none

Results:

• Alerts are generated correctly
• DNP3 parser works
• Different dnp3_func values match depending on PCAP

Same test in pfSense

On pfSense:

• Same PCAPs
• Same rules (via custom rules / local.rules equivalent)
• Snort enabled on the appropriate interface
• Didn't tweak any other advanced settings apart from enabling SCADA preprocessors

Observations in pfSense:

Broad rule works:

alert tcp any any -> any 20000 \(msg:"ANY DNP3 TRAFFIC"; sid:1000001; rev:1;)

Modbus rules (modbus_func) work correctly

DNP3 rules using dnp3_func do NOT trigger:

alert tcp any any -> any 20000 \(msg:"DNP3 READ"; dnp3_func:read; sid:1000002; rev:1;)

Hence, DNP3 preprocessor does not appear to be active or parsing the traffic.

What I’m trying to confirm

• Does Snort package 4.1.6_28 include full DNP3 preprocessor support?
• Is there any additional GUI setting required to enable DNP3 (similar to other preprocessors)?
• Has anyone successfully used dnp3_func rules in pfSense Snort recently?

Any pointers would be really appreciated especially from anyone running OT/ICS rules on pfSense Snort.
Thanks!

TL;DR

Snort 2.9.20 standalone → DNP3 rules work
pfSense Snort → traffic seen, basic rules work, Modbus works
DNP3 rules (dnp3_func) → no alerts