# IPS Doesn't seem to be doing anything **URL:** \ **Category:** Intrusion Prevention\ **Created:** [9 July 2026 15:53 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-be-doing-anything/15937 "2026-07-09T15:53:50Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![fauxbitmask](https://community.ipfire.org/user_avatar/community.ipfire.org/fauxbitmask/32/15706_2.png) [@fauxbitmask](https://community.ipfire.org/u/fauxbitmask)\ **Post date:** [9 July 2026 15:53 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-be-doing-anything/15937/1 "2026-07-09T15:53:50Z")
Hello everyone. I’ve been using IPFire for quite a long time now and decided to try using the intrusion prevention feature. I’ve had it turned on for a while and nothing is being logged. I’m on Core Update 202. Could be that I hadn’t configured it correctly. I went back through all my settings following the guide in the documentation. The system shows IPS running in the web GUI as well as doing ‘/etc/rc.d/init.d/suricata status’. I have selected two rule sets: [Emergingthreats.net](http://Emergingthreats.net) Community rules and Snort/VRT GPLv2 Community Rules. From there I have selected “customize ruleset” and for testing purposes I’ve enabled emerging-dshield.rules\>ET DROP Dshield Block Listed Source group 1. I’ve also enabled emerging-attack\_response.rules\>GPL ATTACK\_RESPONSE id check returned root and then tried going to [http://testmyids.com/](http://testmyids.com/) in my browser as well as with CURL. Nothing is being triggered. One thing of note is that when I try to save the settings in “customize ruleset” I am given a blank white screen in the web GUI and the page it is trying to load is at cgi-bin/ids.cgi. If I reload that URL manually it comes back to the IPS page but it doesn’t seem like the rules have been applied. Is there something specific I can check in the system to verify if rules are applied? ---
**Author:** ![bonnietwin](https://community.ipfire.org/user_avatar/community.ipfire.org/bonnietwin/32/12350_2.png) [@bonnietwin](https://community.ipfire.org/u/bonnietwin)\ **Post date:** [9 July 2026 15:59 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-be-doing-anything/15937/2 "2026-07-09T15:59:38Z")
Hallo @fauxbitmask Welcome to the IPFire community. Could you show the last few lines with a date from when you tried to “customize ruleset” from the file `/var/log/httpd/error_log`. ---
**Author:** ![fauxbitmask](https://community.ipfire.org/user_avatar/community.ipfire.org/fauxbitmask/32/15706_2.png) [@fauxbitmask](https://community.ipfire.org/u/fauxbitmask)\ **Post date:** [9 July 2026 16:04 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-be-doing-anything/15937/3 "2026-07-09T16:04:36Z")
This looks like something: [Wed Jul 08 17:43:52.889029 2026] [core:notice] [pid 2804:tid 2804] AH00094: Command line: ‘/usr/sbin/httpd’ Could not write to /var/ipfire/suricata/suricata-used-rulesfiles.yaml. Permission denied [Wed Jul 08 17:52:38.917997 2026] [mpm\_event:notice] [pid 2804:tid 2804] AH00491: caught SIGTERM, shutting down [Wed Jul 08 17:54:14.897488 2026] [mpm\_event:notice] [pid 2787:tid 2787] AH00489: Apache/2.4.67 (Unix) OpenSSL/3.6.2 configured – resuming normal operations [Wed Jul 08 17:54:14.897940 2026] [core:notice] [pid 2787:tid 2787] AH00094: Command line: ‘/usr/sbin/httpd’ Could not write to /var/ipfire/suricata/suricata-used-rulesfiles.yaml. Permission denied ---
**Author:** ![fauxbitmask](https://community.ipfire.org/user_avatar/community.ipfire.org/fauxbitmask/32/15706_2.png) [@fauxbitmask](https://community.ipfire.org/u/fauxbitmask)\ **Post date:** [9 July 2026 16:06 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-be-doing-anything/15937/4 "2026-07-09T16:06:36Z")
Here are permissions listings: -rw-r–r-- 1 root root 6244 Apr 21 04:54 ruleset-sources -rw-r–r-- 1 root root 113 Jan 8 2025 suricata-used-rulesfiles.yaml ---
**Author:** ![bonnietwin](https://community.ipfire.org/user_avatar/community.ipfire.org/bonnietwin/32/12350_2.png) [@bonnietwin](https://community.ipfire.org/u/bonnietwin)\ **Post date:** [9 July 2026 16:06 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-be-doing-anything/15937/5 "2026-07-09T16:06:53Z")
Okay. Please show the results of the command `ls -hal /var/ipfire/suricata/` ---
**Author:** ![fauxbitmask](https://community.ipfire.org/user_avatar/community.ipfire.org/fauxbitmask/32/15706_2.png) [@fauxbitmask](https://community.ipfire.org/u/fauxbitmask)\ **Post date:** [9 July 2026 16:10 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-be-doing-anything/15937/6 "2026-07-09T16:10:05Z")
total 56K drwxr-xr-x 2 nobody nobody 4.0K Jul 8 17:33 . drwxr-xr-x 52 root root 4.0K May 21 13:15 .. -rw-r–r-- 1 nobody nobody 0 Jul 9 08:52 community-used-rulesfiles -rw-r–r-- 1 nobody nobody 70 Jul 9 08:52 emerging-used-rulesfiles -rw-r–r-- 1 nobody nobody 27 Jul 8 17:32 etags -rw-r–r-- 1 nobody nobody 31 Jul 8 15:48 ignored -rw-r–r-- 1 nobody nobody 0 Apr 14 2022 oinkmaster-modify-sids.conf -rw-r–r-- 1 nobody nobody 0 Apr 14 2022 oinkmaster-provider-includes.conf -rw-r–r-- 1 nobody nobody 65 Jul 8 17:32 providers-settings -rw-r–r-- 1 nobody nobody 196 Jul 9 08:21 reporter.conf -rw-r–r-- 1 root root 6.1K Apr 21 04:54 ruleset-sources -rw-r–r-- 1 nobody nobody 320 Jul 9 08:21 settings -rw-r–r-- 1 nobody nobody 170 Jul 9 08:21 suricata-dns-servers.yaml -rw-r–r-- 1 nobody nobody 122 Jul 9 08:21 suricata-homenet.yaml -rw-r–r-- 1 nobody nobody 98 Jul 9 08:21 suricata-http-ports.yaml -rw-r–r-- 1 nobody nobody 0 Apr 14 2022 suricata-used-providers.yaml -rw-r–r-- 1 root root 113 Jan 8 2025 suricata-used-rulesfiles.yaml ---
**Author:** ![bonnietwin](https://community.ipfire.org/user_avatar/community.ipfire.org/bonnietwin/32/12350_2.png) [@bonnietwin](https://community.ipfire.org/u/bonnietwin)\ **Post date:** [9 July 2026 16:12 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-be-doing-anything/15937/7 "2026-07-09T16:12:09Z")
Okay, you provided what I was looking for as I was asking for it. 😁 Are those the only two entries in that directory? The ruleset-sources file should be root:root ownership but suricata-used-rulesfiles.yaml should be nobody:nobody. I just saw that you provided the whole set from that directory. For some reason on your system the ownership of suricata-used-rulesfiles.yaml has been changed from nobody:nobody to root:root. The permissions for all the files in that directory are fine. Change it back to nobody:nobody and try again. ---
**Author:** ![fauxbitmask](https://community.ipfire.org/user_avatar/community.ipfire.org/fauxbitmask/32/15706_2.png) [@fauxbitmask](https://community.ipfire.org/u/fauxbitmask)\ **Post date:** [9 July 2026 16:15 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-be-doing-anything/15937/8 "2026-07-09T16:15:44Z")
It’s a bingo! That solved the problem of the WUI hanging. The file now shows updated as of now and when I do curl [http://testmynids.org/uid/index.html](http://testmynids.org/uid/index.html) I am now indeed getting log entries. Simples. Thank you!