Snort [PFSense] is configured but not blocking or generating alerts!

Question

I've got PFSense V 2.0-RC1 (i386) and I've got the latest version of Snort installed

I've loaded up a bunch of rules from Oinkmaster, I've enabled all of the preprocessors, and I've ensured the service is started.

When I let it sit for a while and then check my Alerts and Block list, there are no entries. Even when I test it by logging into Skype (skype is listed as a Rule from P2P), I don't get any entries in the logs.

If you need any further information, please let me know... I simply can't figure this one out.

Answer 1

Check the logs for errors regarding Snort, and verify the interface is "started" in the Snort Interfaces tab. There should be a red "X" next to the interface ("WAN" for example). Also be sure to click the "Update Rules" button on the Update tab. You could also try updating pfSense to RELEASE.