IPS not working

[GG_jr (Gabriel GHEORGHIU)]

@fasttech

For rules to trigger, the traffic must impact the sensor.Without knowing the network topology this is hard to troubleshoot. If this test instance is a vm that’s not processing the traffic for clients ‘behind’ it then how can it see traffic to trigger a rule?What rule are you trying to trigger?

Hi @fasttech,
Basically you’re right but:

1. NS is installed on a dedicated server machine and acting as UTM.
2. RED eth is connected to the internet with public ip (WAN).
3. GREEN eth is connected to LAN with private IP.
4. No firewall rules for inbound and/or outbound; only Web Proxy and Web Filter.
5. IPS is enabled with Balanced Rule Policy (tested also with Connectivity and Security Rules Policy, as @AZChas already did). Aren’t these Rules as trigger? Isn’t RED eth the sensor? I think yes. So, if these Rules is supposed to be working well, must be something written in IPS report. Am I wrong?
6. I’m sure is some activity out there, like @stephdl said here:
   Nethserver-fail2ban needs testers - #6 by stephdl
7. I want to use NS in production. In this moment I use it in paralel with Endian UTM.
   Please see what Endian show about IPS and how Endian use IPS.