Hello everyone. I’ve been using IPFire for quite a long time now and decided to try using the intrusion prevention feature. I’ve had it turned on for a while and nothing is being logged. I’m on Core Update 202.
Could be that I hadn’t configured it correctly. I went back through all my settings following the guide in the documentation. The system shows IPS running in the web GUI as well as doing ‘/etc/rc.d/init.d/suricata status’. I have selected two rule sets: Emergingthreats.net Community rules and Snort/VRT GPLv2 Community Rules. From there I have selected “customize ruleset” and for testing purposes I’ve enabled emerging-dshield.rules>ET DROP Dshield Block Listed Source group 1. I’ve also enabled emerging-attack_response.rules>GPL ATTACK_RESPONSE id check returned root and then tried going to http://testmyids.com/ in my browser as well as with CURL. Nothing is being triggered. One thing of note is that when I try to save the settings in “customize ruleset” I am given a blank white screen in the web GUI and the page it is trying to load is at cgi-bin/ids.cgi. If I reload that URL manually it comes back to the IPS page but it doesn’t seem like the rules have been applied.
Is there something specific I can check in the system to verify if rules are applied?
Hallo @fauxbitmask
Welcome to the IPFire community.
Could you show the last few lines with a date from when you tried to “customize ruleset” from the file /var/log/httpd/error_log.
This looks like something:
[Wed Jul 08 17:43:52.889029 2026] [core:notice] [pid 2804:tid 2804] AH00094: Command line: ‘/usr/sbin/httpd’
Could not write to /var/ipfire/suricata/suricata-used-rulesfiles.yaml. Permission denied
[Wed Jul 08 17:52:38.917997 2026] [mpm_event:notice] [pid 2804:tid 2804] AH00491: caught SIGTERM, shutting down
[Wed Jul 08 17:54:14.897488 2026] [mpm_event:notice] [pid 2787:tid 2787] AH00489: Apache/2.4.67 (Unix) OpenSSL/3.6.2 configured – resuming normal operations
[Wed Jul 08 17:54:14.897940 2026] [core:notice] [pid 2787:tid 2787] AH00094: Command line: ‘/usr/sbin/httpd’
Could not write to /var/ipfire/suricata/suricata-used-rulesfiles.yaml. Permission denied
Here are permissions listings:
-rw-r–r-- 1 root root 6244 Apr 21 04:54 ruleset-sources
-rw-r–r-- 1 root root 113 Jan 8 2025 suricata-used-rulesfiles.yaml
Okay.
Please show the results of the command ls -hal /var/ipfire/suricata/
total 56K
drwxr-xr-x 2 nobody nobody 4.0K Jul 8 17:33 .
drwxr-xr-x 52 root root 4.0K May 21 13:15 ..
-rw-r–r-- 1 nobody nobody 0 Jul 9 08:52 community-used-rulesfiles
-rw-r–r-- 1 nobody nobody 70 Jul 9 08:52 emerging-used-rulesfiles
-rw-r–r-- 1 nobody nobody 27 Jul 8 17:32 etags
-rw-r–r-- 1 nobody nobody 31 Jul 8 15:48 ignored
-rw-r–r-- 1 nobody nobody 0 Apr 14 2022 oinkmaster-modify-sids.conf
-rw-r–r-- 1 nobody nobody 0 Apr 14 2022 oinkmaster-provider-includes.conf
-rw-r–r-- 1 nobody nobody 65 Jul 8 17:32 providers-settings
-rw-r–r-- 1 nobody nobody 196 Jul 9 08:21 reporter.conf
-rw-r–r-- 1 root root 6.1K Apr 21 04:54 ruleset-sources
-rw-r–r-- 1 nobody nobody 320 Jul 9 08:21 settings
-rw-r–r-- 1 nobody nobody 170 Jul 9 08:21 suricata-dns-servers.yaml
-rw-r–r-- 1 nobody nobody 122 Jul 9 08:21 suricata-homenet.yaml
-rw-r–r-- 1 nobody nobody 98 Jul 9 08:21 suricata-http-ports.yaml
-rw-r–r-- 1 nobody nobody 0 Apr 14 2022 suricata-used-providers.yaml
-rw-r–r-- 1 root root 113 Jan 8 2025 suricata-used-rulesfiles.yaml
Okay, you provided what I was looking for as I was asking for it. 
Are those the only two entries in that directory?
The ruleset-sources file should be root:root ownership but suricata-used-rulesfiles.yaml should be nobody:nobody.
I just saw that you provided the whole set from that directory.
For some reason on your system the ownership of suricata-used-rulesfiles.yaml has been changed from nobody:nobody to root:root.
The permissions for all the files in that directory are fine.
Change it back to nobody:nobody and try again.
It’s a bingo! That solved the problem of the WUI hanging. The file now shows updated as of now and when I do curl http://testmynids.org/uid/index.html I am now indeed getting log entries.
Simples. Thank you!