Help:In 2.1 ,the snort's blocked is automatically cleared
-
The blocked snort soon be automatically cleared (regardless of how long to set clear, are within 1 hour, the system automatically cleared)
sys:
pfsense 2.1 i386
sonrt 2.9.4.6 pkg v. 2.5.9 -
As it currently stands, a filter_reload launched by pfSense (settings change, etc.) will clear the snort2c-list which contains the blocked IP's. Maybe bmeeks can figure out a way to make it persist through filter_reload in the future, but currently it's "by design" as far as I can tell.
Edit:
More info in this thread: http://forum.pfsense.org/index.php/topic,66904.0.html -
I discussed this with one of the pfSense Core Team members. He acknowledged this is caused by the filter_reload() function in 2.1 and some changes within it. He has this on his list to look at fixing. That's the good news. The bad news is since this is something in the core code and not in the Snort package, it will take a longer time to work its way into the patch update process.
Bill
