Page MenuHomeVyOS Platform

Inspect action still exists in firewall and should be removed
Closed, ResolvedPublicBUG


# set firewall name Foo rule 10 action 
Possible completions:
   drop         Rule action to drop
   reject       Rule action to reject
   accept       Rule action to accept
   inspect      Rule action to inspect

The inspect action was for the IPS/IDS (Snort), which is long gone. It's confusing at best, and possibly network breaking because it looks benign, but its real effect in the current system is "drop all traffic".
Until we figure out how to get the IPS functionality back, it should not be there.


Difficulty level
Easy (less than an hour)

Event Timeline

Did you run into some trouble with snort? Are there any discussion on this topic somewhere?

N.B. May be just change the code to do '-j LOG' on this action, if snort is not an option?

syncer changed the subtype of this task from "Task" to "Bug".Oct 20 2018, 4:51 AM