Snort does not *block* after upgrade to 2.3 [SOLVED]

[D-Kun]

Hi,

alerts as usual - but snort does not block the alerts as before. Anyone else who got the same issue? Or any hints how to resolve?

Greetings

[bmeeks]

@D-Kun:

Hi,

alerts as usual - but snort does not block the alerts as before. Anyone else who got the same issue? Or any hints how to resolve?

Greetings

Snort does block in 2.3.  I've tested this multiple times on virtual machines.  How are you judging "does not block"?  Are you solely looking at the BLOCKS tab and finding it empty?  If so, there is a GUI display bug that is fixed in the update posted now for the pfSense team to review and merge.  You can work around the bug by typing a value in the "number of blocked hosts to display" field and saving it.  Then reload the page.

Bill

[D-Kun]

Hi Bill!

Are you solely looking at the BLOCKS tab and finding it empty?  If so, there is a GUI display bug that is fixed in the update posted now for the pfSense team to review and merge.  You can work around the bug by typing a value in the "number of blocked hosts to display" field and saving it.  Then reload the page.

Solved! ;-) thanks!

[bmeeks]

Glad you got it going.  By the way, that update I mentioned was merged and will show up as Snort package version 3.2.9.1_11 on the Package Manager screen.

Bill