Changes in the interface configuration are not applied when suricata is being reloaded. Populating the IPS chain must be moved into a function and that function must be called in the suricata init script every time suricata is being started or reloaded.
Fixed: https://git.ipfire.org/?p=people/stevee/ipfire-2.x.git;a=commit;h=c9b07d6a0cdb54c71d5aef4a75c40d505585a0fe