Snort enable react
I like to use the "config enable_react" parameter to show a http site on blocked ips. The SNORT package dont't know this config parameter so I think this option is not used during the build.
Could you please use "./configure --enable-react / -DENABLE_REACT" as an additional build option in further builds?
Updated by Bill Meeks over 2 years ago
Snort on pfSense currently runs in what is really IDS mode using libpcap. The "blocking" done by Snort uses a custom output plugin that interacts with the pf (packet filter) firewall in FreeBSD. In order to use the REACT mode, Snort must be running using Inline IPS mode. That mode is not currently supported on pfSense.