Snort enable react
Plus Target Version:
I like to use the "config enable_react" parameter to show a http site on blocked ips. The SNORT package dont't know this config parameter so I think this option is not used during the build.
Could you please use "./configure --enable-react / -DENABLE_REACT" as an additional build option in further builds?
Updated by Jared Dillard about 4 years ago
- Category set to Snort
Updated by Bill Meeks about 4 years ago
Snort on pfSense currently runs in what is really IDS mode using libpcap. The "blocking" done by Snort uses a custom output plugin that interacts with the pf (packet filter) firewall in FreeBSD. In order to use the REACT mode, Snort must be running using Inline IPS mode. That mode is not currently supported on pfSense.