I turned on IPS and it is blocking my DDNS domain service on IPFire! Any suggestions on how to prevent this? Can I whitelist DNS names even though it asks for IP addresses? You would think the IPS system would ignore IPFire’s own DDNS service.
The IPFire Intrusion Prevention System has raised the following alert:
Signature : ET POLICY DNS Query to DynDNS Domain *.ddns .net
Category : Potentially Bad Traffic
Severity : Medium Severity
Timestamp : Wednesday, 29 April 2026 at 09:25:00 UTC-05:00
That is being triggered because you chose to select the ET Policy category. It looks like your situation is not appropriate for using ET Policy. The description of this category is
Policy–This category is for signatures that may indicate
violations to an organization’s policy. This can include protocols
prone to abuse, and other application-level transactions which
may be of interest.
The simplest is to uncheck the ET Policy category under the Emerging Threats provider.
If you are an organisation that requires the ET Policy categories to be filtered out, except for the DDNS one then you could leave ET Policy enabled but uncheck any of the rules in that category that are related to DDNS.
I just did a quick check in the emerging-policy.rules category and there are 4 rules in that category that include ddns in the description.
All four of those rules are selected by default by Emerging Threats in the ET Policy category. If you want to keep the other policy requirements for things like employees accessing OS update sites (if you have your own central OS update server), pastebin sites or trying to access the TOR network then you could just uncheck those four rules that include ddns in the description and it stops blocking the ddns traffic requests but blocks all the other policy requirements.
Thank you! I only need the ddns.net rule. I appreciate you pointing me in the right place and explaining the policy!