Project

General

Profile

Feature #9289

Snort enable react

Added by Theo Wolf 3 months ago. Updated about 1 month ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Snort
Target version:
-
Start date:
01/23/2019
Due date:
% Done:

0%

Estimated time:

Description

I like to use the "config enable_react" parameter to show a http site on blocked ips. The SNORT package dont't know this config parameter so I think this option is not used during the build.
Could you please use "./configure --enable-react / -DENABLE_REACT" as an additional build option in further builds?

Thanks,
Theo

History

#1 Updated by Jared Dillard 2 months ago

  • Category set to Snort

#2 Updated by Bill Meeks about 1 month ago

Snort on pfSense currently runs in what is really IDS mode using libpcap. The "blocking" done by Snort uses a custom output plugin that interacts with the pf (packet filter) firewall in FreeBSD. In order to use the REACT mode, Snort must be running using Inline IPS mode. That mode is not currently supported on pfSense.

Also available in: Atom PDF