# IPS doesn't seem to work **URL:** \ **Category:** Installing & Running IPFire\ **Created:** [14 December 2021 15:50 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-work/6823 "2021-12-14T15:50:18Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![gr0mit](https://community.ipfire.org/user_avatar/community.ipfire.org/gr0mit/32/10127_2.png) [@gr0mit](https://community.ipfire.org/u/gr0mit)\ **Post date:** [14 December 2021 15:50 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-work/6823/1 "2021-12-14T15:50:18Z")
Hi, I have problems getting IPS to work: IPS Activated and enabled on Red, Green and OpenVPN. I use the [Emergingthreads.net](http://Emergingthreads.net) Community Rules and have some catagories activated. ![ips](https://community.ipfire.org/uploads/default/original/2X/0/091eb5514efa85d5cea99699e1f67873e63d9cdb.png) Anyhow in the IPS log it says 0 rules are active. What am I doing wrong? Greetings Arne ---
**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\ **Post date:** [14 December 2021 16:34 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-work/6823/2 "2021-12-14T16:34:47Z")
Hi, > [@gr0mit](#): > > Anyhow in the IPS log it says 0 rules are active. where do you read this message? Are you perhaps running [Core Update 162 (testing)](https://blog.ipfire.org/post/ipfire-2-27-core-update-162-is-available-for-testing)? If so, please refer to [this](https://community.ipfire.org/t/core-update-162-suricata-emits-logspam-galore/6757/2) thread. Thanks, and best regards, Peter Müller ---
**Author:** ![gr0mit](https://community.ipfire.org/user_avatar/community.ipfire.org/gr0mit/32/10127_2.png) [@gr0mit](https://community.ipfire.org/u/gr0mit)\ **Post date:** [14 December 2021 16:42 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-work/6823/3 "2021-12-14T16:42:08Z")
Thanks for your reply. I’m running 161 and the message shows up under Logs/IPS Logs: ![Screenshot 2021-12-14 174135](https://community.ipfire.org/uploads/default/original/2X/d/d3559a6a94f5231e5a8227b905a1e00d7336d290.png) ---
**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\ **Post date:** [14 December 2021 16:52 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-work/6823/4 "2021-12-14T16:52:54Z")
Hi, this is a misunderstanding then: “Activated rules” refers to triggered rules (sometimes also called “rule hits”) here. You can check whether your IPS is actually working by trying to trigger rules manually (such as conducting a portscan), or executing this command on a machine behind IPFire: ```auto curl http://testmyids.com/ ``` If you enabled the `emerging-attack_response.rules` category, you should see a hit afterwards. Should your IPFire be connected to the internet directly, you should see tons of IPS rules triggered within a short time (usually less than a minute). Thanks, and best regards, Peter Müller ---
**Author:** ![gr0mit](https://community.ipfire.org/user_avatar/community.ipfire.org/gr0mit/32/10127_2.png) [@gr0mit](https://community.ipfire.org/u/gr0mit)\ **Post date:** [14 December 2021 17:10 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-work/6823/5 "2021-12-14T17:10:51Z")
Thanks for your reply Peter. The IPFire is locate behind a Telekom router. And I never had any activities at all in the log. Tried the following from a PC behind the IPFire but also nothing in the log: ![Screenshot 2021-12-14 180730](https://community.ipfire.org/uploads/default/original/2X/0/09773c337ed7e2b47a73bc0aaf0f5169119d37cc.png) Anyhow not all rules under ‘emerging-attack\_response.rules’ are activated by default when I check it. ---
**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\ **Post date:** [14 December 2021 17:18 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-work/6823/6 "2021-12-14T17:18:21Z")
Hi, > [@gr0mit](#): > > And I never had any activities at all in the log. oh, so you either have a very clean network, or the IPS did not detect anything. 🙂 > [@gr0mit](#): > > Tried the following from a PC behind the IPFire but also nothing in the log: Ah yes, apparently, this service moved to HTTPS now, which the IPS cannot intercept. This is why the string you get in return does not trigger anything anymore. 😑 To provoke an IDS hit, could you try a portscan instead? ```auto nmap -v -A [destination] ``` should be sufficient if the `emerging-scan.rules` category is enabled. > [@gr0mit](#): > > Anyhow not all rules under ‘emerging-attack\_response.rules’ are activated by default when I check it. Yes, this is intended. Not all rules are enabled by default. IPFire does not interfere here, the provider of IPS rules chooses whether they come enabled or disabled. Thanks, and best regards, Peter Müller ---
**Author:** ![roberto](https://community.ipfire.org/user_avatar/community.ipfire.org/roberto/32/8265_2.png) [@roberto](https://community.ipfire.org/u/roberto)\ **Post date:** [14 December 2021 17:20 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-work/6823/7 "2021-12-14T17:20:17Z")
Hi @gr0mit. If you activate the DMZ Host on the Router so that all internet requests are sent to the WAN interface of the IPFire, you will see the amount that reaches you. Try ir and say Us. Regards. ---
**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\ **Post date:** [14 December 2021 17:25 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-work/6823/8 "2021-12-14T17:25:39Z")
Hi Roberto, I thought so as well, but perhaps that isn’t possible or desired in @gr0mit’s scenario… Anyway, let’s wait for his reply… 🙂 Thanks, and best regards, Peter Müller ---
**Author:** ![gr0mit](https://community.ipfire.org/user_avatar/community.ipfire.org/gr0mit/32/10127_2.png) [@gr0mit](https://community.ipfire.org/u/gr0mit)\ **Post date:** [14 December 2021 17:52 UTC](https://community.ipfire.org/t/ips-doesnt-seem-to-work/6823/9 "2021-12-14T17:52:32Z")
Finally getting some entries in the log with nmap: ![Screenshot 2021-12-14 184916](https://community.ipfire.org/uploads/default/original/2X/5/5d37467fe51a6bdd167a0d210d911306b84947a1.png) Does it make sense to activate the DMZ host on the Lancom router and to forward the traffic directly to IPFire? Anyhow thanks for the help so far!