# Core-161: Location Blocking stops Green access **URL:** \ **Category:** Firewall Rules\ **Created:** [1 December 2021 19:00 UTC](https://community.ipfire.org/t/core-161-location-blocking-stops-green-access/6736 "2021-12-01T19:00:32Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![cas-ipfire](https://community.ipfire.org/user_avatar/community.ipfire.org/cas-ipfire/32/4376_2.png) [@cas-ipfire](https://community.ipfire.org/u/cas-ipfire)\ **Post date:** [1 December 2021 19:00 UTC](https://community.ipfire.org/t/core-161-location-blocking-stops-green-access/6736/1 "2021-12-01T19:00:32Z")
Yesterday I upgraded to Core-161 (x86\_64) and today I attempted to perform an update on my Linux OS on the green side of the firewall and all access to the update servers were blocked. The logs show that IPS recognized the request for what it was (an APT update), but the firewall logs by country show all as being blocked from country “green0.” I have GeoIP blocking enabled with only a few locations open, but “green” is not shown as a country and the Green IP space uses the non-routable public class B IP addresses (172.16.0.0). The only solution at this point seems to be to turn off IP blocking or putting is a specific iptable rule to allow green as I am unable to determine how to unblock country “Green”. Thanks, -Craig ---
**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\ **Post date:** [1 December 2021 20:54 UTC](https://community.ipfire.org/t/core-161-location-blocking-stops-green-access/6736/2 "2021-12-01T20:54:50Z")
Hi, the location block - it is no longer called “GeoIP block”, since [we do not use MaxMind’s GeoIP database anymore](https://blog.ipfire.org/post/on-retiring-the-maxmind-geoip-database) - only applies to _incoming_ connections, not to _outgoing_ (i. e. initiated by a client within an internal network) ones. Therefore, it does not block the connection in question. Also, it does not log dropped packets, since it’s sole purpose is to reduce noise in the firewall. Hence, another component is interferring in your case. > The logs show that IPS recognized the request for what it was (an APT update) Unless you have configured the IPS in a way to [monitor traffic only](https://wiki.ipfire.org/configuration/firewall/ips), a log message implicates the offending packet has been dropped. Please disable the rule causing this log entry (it should be a “shellcode”-related one), and the IPS should no longer block the updates. Also, please post the _actual_ logs next time, not just a description of them. To me, this would make analysing more easy. 🙂 Thanks, and best regards, Peter Müller P.S.: Also, I’d be surprised if this was related to Core Update 161. ---
**Author:** ![cas-ipfire](https://community.ipfire.org/user_avatar/community.ipfire.org/cas-ipfire/32/4376_2.png) [@cas-ipfire](https://community.ipfire.org/u/cas-ipfire)\ **Post date:** [1 December 2021 21:57 UTC](https://community.ipfire.org/t/core-161-location-blocking-stops-green-access/6736/3 "2021-12-01T21:57:39Z")
Update, this does not appear to be an IPS issue as turning off the Location-based blocking completely eliminates the problem. Below I include both the Location log and the a portion of the IPS log (I can include the full IPS log if that would help: Now a portion of both logs as I hit the character limit: ## Firewall log (Country) **Total number of firewall hits for December 1: 223** [Older](https://172.16.1.10:444/cgi-bin/logs.cgi/showrequestfromcountry.dat?0,11,1,green0) Newer | **Time** | **Chain** | **Iface** | **Proto** | **Source** | **Src Port** | **Destination** | **Dst Port** | | --- | --- | --- | --- | --- | --- | --- | --- | | 08:52:45 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 39720 | [107.22.164.118]([https://172.16.1.10:444/cgi-](https://172.16.1.10:444/cgi-) | | | 08:53:06 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63582 | [66.111.4.55](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.55) | 443 | | 08:53:07 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 58352 | [13.224.2.168](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=13.224.2.168) | 443 | | 08:53:07 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 43120 | [142.250.217.67](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.67) | 443 | | 08:53:07 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 47284 | [99.86.38.70](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=99.86.38.70) | 443 | | 08:53:08 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63582 | [66.111.4.55](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.55) | 443 | | 08:53:10 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 44322 | [172.16.1.10](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.10) | 444 | | 08:53:16 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63581 | [142.250.99.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.99.188) | 5228 | | 08:53:18 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63582 | [66.111.4.55](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.55) | 443 | | 08:53:21 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 39718 | [107.22.164.118](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=107.22.164.118) | 443 | | 08:53:21 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 38962 | [44.196.206.82](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=44.196.206.82) | 443 | | 08:53:21 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 39720 | [107.22.164.118](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=107.22.164.118) | 443 | | 08:53:23 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 53686 | [54.208.76.219](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=54.208.76.219) | 443 | | 08:53:35 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 47284 | [99.86.38.70](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=99.86.38.70) | 443 | | 08:53:35 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 43120 | [142.250.217.67](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.67) | 443 | | 08:53:35 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 58352 | [13.224.2.168](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=13.224.2.168) | 443 | | 08:53:41 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 44322 | [172.16.1.10](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.10) | 444 | | 08:53:57 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 39720 | [107.22.164.118](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=107.22.164.118) | 443 | | 08:53:57 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 38962 | [44.196.206.82](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=44.196.206.82) | 443 | | 08:53:57 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 39718 | [107.22.164.118](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=107.22.164.118) | 443 | | 08:53:59 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.69](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.69) | 53686 | [54.208.76.219](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=54.208.76.219) | 443 | | 08:59:13 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63591 | [142.250.217.106](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.106) | 443 | | 08:59:13 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63591 | [142.250.217.106](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.106) | 443 | | 08:59:13 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63581 | [142.250.99.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.99.188) | 5228 | | 08:59:27 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63601 | [142.251.33.78](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.78) | 443 | | 08:59:27 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63601 | [142.251.33.78](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.78) | 443 | | 08:59:27 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63601 | [142.251.33.78](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.78) | 443 | | 08:59:27 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63601 | [142.251.33.78](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.78) | 443 | | 08:59:28 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63601 | [142.251.33.78](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.78) | 443 | | 08:59:28 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63601 | [142.251.33.78](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.78) | 443 | | 08:59:28 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63601 | [142.251.33.78](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.78) | 443 | | 08:59:28 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63581 | [142.250.99.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.99.188) | 5228 | | 08:59:29 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63601 | [142.251.33.78](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.78) | 443 | | 08:59:29 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63601 | [142.251.33.78](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.78) | 443 | | 08:59:33 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63601 | [142.251.33.78](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.78) | 443 | | 08:59:35 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63601 | [142.251.33.78](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.78) | 443 | | 09:00:31 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63584 | [52.202.62.217](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=52.202.62.217) | 443 | | 09:06:49 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63660 | [3.235.73.96](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.73.96) | 443 | | 10:12:00 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64273 | [3.235.72.249](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.72.249) | 443 | | 10:12:00 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64284 | [3.235.96.62](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.96.62) | 443 | | 10:12:23 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63632 | [142.250.99.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.99.188) | 5228 | | 10:13:39 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63632 | [142.250.99.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.99.188) | 5228 | | 10:14:54 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63632 | [142.250.99.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.99.188) | 5228 | | 10:15:37 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64352 | [3.235.96.63](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.96.63) | 443 | | 10:15:37 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64387 | [3.235.73.96](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.73.96) | 443 | | 10:15:37 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64351 | [18.205.93.142](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.142) | 443 | | 10:15:37 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64353 | [18.205.93.142](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.142) | 443 | | 10:15:37 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64354 | [18.205.93.142](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.142) | 443 | | 10:16:09 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63632 | [142.250.99.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.99.188) | 5228 | | 10:17:25 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63632 | [142.250.99.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.99.188) | 5228 | | 10:18:41 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63632 | [142.250.99.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.99.188) | 5228 | | 10:19:56 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63632 | [142.250.99.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.99.188) | 5228 | | 10:21:11 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 63632 | [142.250.99.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.99.188) | 5228 | | 10:24:07 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64415 | [52.202.62.224](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=52.202.62.224) | 443 | | 11:15:52 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64543 | [3.235.96.62](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.96.62) | 443 | | 11:15:52 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64550 | [3.235.83.109](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.83.109) | 443 | | 12:08:28 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64616 | [74.125.142.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=74.125.142.188) | 5228 | | 12:08:29 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64508 | [18.205.93.224](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.224) | 443 | | 12:08:29 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64610 | [3.235.83.123](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.83.123) | 443 | | 12:08:29 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64616 | [74.125.142.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=74.125.142.188) | 5228 | | 12:08:29 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64508 | [18.205.93.224](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.224) | 443 | | 12:08:29 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64610 | [3.235.83.123](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.83.123) | 443 | | 12:08:29 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64508 | [18.205.93.224](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.224) | 443 | | 12:08:29 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64616 | [74.125.142.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=74.125.142.188) | 5228 | | 12:08:29 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64610 | [3.235.83.123](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.83.123) | 443 | | 12:08:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64508 | [18.205.93.224](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.224) | 443 | | 12:08:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64616 | [74.125.142.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=74.125.142.188) | 5228 | | 12:08:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64508 | [18.205.93.224](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.224) | 443 | | 12:08:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64610 | [3.235.83.123](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.83.123) | 443 | | 12:08:31 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64616 | [74.125.142.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=74.125.142.188) | 5228 | | 12:08:31 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64508 | [18.205.93.224](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.224) | 443 | | 12:08:33 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64616 | [74.125.142.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=74.125.142.188) | 5228 | | 12:08:44 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64613 | [20.189.173.5](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=20.189.173.5) | 443 | | 12:36:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64653 | [3.235.73.120](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.73.120) | 443 | | 12:36:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64626 | [18.205.93.248](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.248) | 443 | | 12:36:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64627 | [18.205.93.248](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.248) | 443 | | 12:36:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64628 | [18.205.93.248](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=18.205.93.248) | 443 | | 12:44:22 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64819 | [3.235.83.121](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=3.235.83.121) | 443 | | 13:35:23 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64842 | [173.194.202.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=173.194.202.188) | 5228 | | 13:35:26 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64843 | [142.251.33.99](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.99) | 443 | | 13:35:26 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64843 | [142.251.33.99](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.99) | 443 | | 13:35:26 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64843 | [142.251.33.99](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.99) | 443 | | 13:35:28 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64842 | [173.194.202.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=173.194.202.188) | 5228 | | 13:35:28 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64843 | [142.251.33.99](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.99) | 443 | | 13:35:29 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64843 | [142.251.33.99](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.99) | 443 | | 13:35:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64842 | [173.194.202.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=173.194.202.188) | 5228 | | 13:35:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64845 | [66.111.4.56](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.56) | 443 | | 13:35:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64845 | [66.111.4.56](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.56) | 443 | | 13:35:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64845 | [66.111.4.56](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.56) | 443 | | 13:35:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64845 | [66.111.4.56](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.56) | 443 | | 13:35:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64843 | [142.251.33.99](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.99) | 443 | | 13:35:30 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64845 | [66.111.4.56](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.56) | 443 | | 13:35:32 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64843 | [142.251.33.99](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.99) | 443 | | 13:35:32 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64842 | [173.194.202.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=173.194.202.188) | 5228 | | 13:35:32 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64845 | [66.111.4.56](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.56) | 443 | | 13:35:34 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64843 | [142.251.33.99](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.99) | 443 | | 13:35:34 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64845 | [66.111.4.56](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.56) | 443 | | 13:35:34 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64842 | [173.194.202.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=173.194.202.188) | 5228 | | 13:35:36 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64843 | [142.251.33.99](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.99) | 443 | | 13:35:36 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64845 | [66.111.4.56](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.56) | 443 | | 13:35:36 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64843 | [142.251.33.99](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.251.33.99) | 443 | | 13:35:36 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64842 | [173.194.202.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=173.194.202.188) | 5228 | | 13:35:38 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64842 | [173.194.202.188](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=173.194.202.188) | 5228 | | 13:35:39 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64845 | [66.111.4.56](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.56) | 443 | | 13:35:40 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64845 | [66.111.4.56](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.56) | 443 | | 13:35:46 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64844 | [142.250.217.110](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.110) | 443 | | 13:35:46 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64844 | [142.250.217.110](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.110) | 443 | | 13:35:46 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64844 | [142.250.217.110](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.110) | 443 | | 13:35:46 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64844 | [142.250.217.110](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.110) | 443 | | 13:35:50 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64845 | [66.111.4.56](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=66.111.4.56) | 443 | | 13:35:50 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64844 | [142.250.217.110](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.110) | 443 | | 13:35:50 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64844 | [142.250.217.110](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.110) | 443 | | 13:35:50 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64844 | [142.250.217.110](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.110) | 443 | | 13:35:52 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64844 | [142.250.217.110](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.110) | 443 | | 13:35:56 | DROP\_NEWNOTSYN | green0 | TCP | [172.16.1.59](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=172.16.1.59) | 64844 | [142.250.217.110](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.110) | 443 | **Total number of firewall hits for December 1: 223** IPS Log: **Date:** 12/01 13:20:56 **Name:** ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management * * * **Priority:** 3 **Type:** Not Suspicious Traffic **IP info:** [192.168.4.101](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=192.168.4.101):57022 → [142.250.217.110](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=142.250.217.110):80 **References:** none found **SID:** [2013504](https://threatintel.proofpoint.com/sid/2013504) **Date:** 12/01 13:20:56 **Name:** ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management * * * **Priority:** 3 **Type:** Not Suspicious Traffic **IP info:** [192.168.4.101](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=192.168.4.101):38338 → [91.189.91.39](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=91.189.91.39):80 **References:** none found **SID:** [2013504](https://threatintel.proofpoint.com/sid/2013504) **Date:** 12/01 13:20:56 **Name:** ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management * * * **Priority:** 3 **Type:** Not Suspicious Traffic **IP info:** [192.168.4.101](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=192.168.4.101):56138 → [91.189.88.151](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=91.189.88.151):80 **References:** none found **SID:** [2013504](https://threatintel.proofpoint.com/sid/2013504) **Date:** 12/01 13:20:56 **Name:** ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management * * * **Priority:** 3 **Type:** Not Suspicious Traffic **IP info:** [192.168.4.101](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=192.168.4.101):56326 → [91.189.95.85](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=91.189.95.85):80 **References:** none found **SID:** [2013504](https://threatintel.proofpoint.com/sid/2013504) **Date:** 12/01 13:20:56 **Name:** ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management * * * **Priority:** 3 **Type:** Not Suspicious Traffic **IP info:** [192.168.4.101](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=192.168.4.101):42274 → [91.189.88.152](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=91.189.88.152):80 **References:** none found **SID:** [2013504](https://threatintel.proofpoint.com/sid/2013504) **Date:** 12/01 13:21:26 **Name:** ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management * * * **Priority:** 3 **Type:** Not Suspicious Traffic **IP info:** [192.168.4.101](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=192.168.4.101):38350 → [91.189.91.39](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=91.189.91.39):80 **References:** none found **SID:** [2013504](https://threatintel.proofpoint.com/sid/2013504) **Date:** 12/01 13:21:56 **Name:** ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management * * * **Priority:** 3 **Type:** Not Suspicious Traffic **IP info:** [192.168.4.101](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=192.168.4.101):51658 → [91.189.91.38](https://172.16.1.10:444/cgi-bin/ipinfo.cgi?ip=91.189.91.38):80 **References:** none found **SID:** [2013504](https://threatintel.proofpoint.com/sid/2013504) ---
**Author:** ![arne\_f](https://community.ipfire.org/user_avatar/community.ipfire.org/arne_f/32/12760_2.png) [@arne\_f](https://community.ipfire.org/u/arne_f)\ **Post date:** [2 December 2021 08:11 UTC](https://community.ipfire.org/t/core-161-location-blocking-stops-green-access/6736/4 "2021-12-02T08:11:01Z")
The logged DROP\_NEWNOTSYN is not really usefull because it state that a client still send packets to a already closed or non existant tcp connection. Also keep in mind that when you reload the firewall by disable Location the IPS need time to restart. On slow machines i have seen 30min or more until it is really active again. Be carefull with such ET POLICY rules. They are to block activities that are usually normal. But some company’s like to block such things like apt. ---
**Author:** ![cas-ipfire](https://community.ipfire.org/user_avatar/community.ipfire.org/cas-ipfire/32/4376_2.png) [@cas-ipfire](https://community.ipfire.org/u/cas-ipfire)\ **Post date:** [2 December 2021 19:10 UTC](https://community.ipfire.org/t/core-161-location-blocking-stops-green-access/6736/5 "2021-12-02T19:10:03Z")
Okay, I used the emerging threats community rule set as the default which includes these rules. I will do some more fine tuning, but Is there a reference where I can learn more about the rule sets so I can better understand what I am blocking/allowing? Thank you for your assistance, ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [2 December 2021 22:06 UTC](https://community.ipfire.org/t/core-161-location-blocking-stops-green-access/6736/6 "2021-12-02T22:06:04Z")
This should help: > [@Problems with DNS Configuration](https://community.ipfire.org/t/problems-with-dns-configuration/5574/4): > > I had an issue with apt update when IPS is enabled. Try disabling IPS temporarily (this is just a test). For me there was single rule I had enabled that caused the problem. (Sorry I cannot remember the rule but I’ll keep looking for my notes!) EDIT: Found it! In an IPS rule named: emerging-policy.rules Is a item called: ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management And it was blocking my apt-get update. ---
**Author:** ![cas-ipfire](https://community.ipfire.org/user_avatar/community.ipfire.org/cas-ipfire/32/4376_2.png) [@cas-ipfire](https://community.ipfire.org/u/cas-ipfire)\ **Post date:** [2 December 2021 23:33 UTC](https://community.ipfire.org/t/core-161-location-blocking-stops-green-access/6736/7 "2021-12-02T23:33:15Z")
Jon, Thanks. Based on the earlier post I went looking and found the same rule (and disabled it). So I think I am functional again, but I would like to better understand the rules and what I am blocking and/or allowing as there are many (too many?) options to choose from. ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [3 December 2021 01:20 UTC](https://community.ipfire.org/t/core-161-location-blocking-stops-green-access/6736/8 "2021-12-03T01:20:09Z")
I struggle with IPS also. Basically I turn on something that’s recommended and give it a try for a week. During that week I monitor the log. And then turn off things that interfere (like APT-type things). I have not stumbled across anything that explains the Rulesets. ---
**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\ **Post date:** [4 December 2021 13:35 UTC](https://community.ipfire.org/t/core-161-location-blocking-stops-green-access/6736/9 "2021-12-04T13:35:53Z")
Hi, > [@jon](#): > > I struggle with IPS also. Basically I turn on something that’s recommended and give it a try for a week. During that week I monitor the log. And then turn off things that interfere (like APT-type things). this procedure is called “baselining”: Trying to find out which kind of findings an IDS/IPS produces, and which of them are false positives. Especially in production networks or enterprises, rules are always enabled step-by-step, watching the logs closely afterwards. Even large companies with a dedicated IDS/IPS team needs weeks if not months to conduct a proper baselining, especially if network documentation is poor. Some of the rulesets are easy: You never want to connect to known C&C servers or hostile networks, no matter what. These can be enabled first, and usually do not cause any headache in terms of false positives. (The real headache comes with the true positives… 🙂 ) Afterwards, rules are commonly enabled by priority: For example, if an IDS/IPS shields client networks, it usually makes more sense to take a look at rulesets like `emerging-web_client.rules` first. Should you are dealing with server networks, protocol-specific rulesets such as `emerging-web_specific_apps.rules` might be more important. Then, there are some rulesets that you want to have enabled in almost any circumstances, such as `emerging-malware.rules`, `emerging-exploit.rules` or `emerging-attack_response.rules` - unless some of these cause too many false positives for certain applications or devices. So, in the end, binging an IPS into production is an individual procedure, and general advice is usually sketchy. Being patient helps, and enabling things one by one - if you can overlook your network, you usually have some kind of feeling of what’s normal inside it and what’s not. > I have not stumbled across anything that explains the Rulesets. For Emerging Threats, [this](https://docs.emergingthreats.net/bin/view/Main/EmergingFAQ) and [this](https://docs.emergingthreats.net/bin/view/Main/AllRulesets) page provide some, but not a complete explanation. Hope this answer was helpful. Thanks, and best regards, Peter Müller