**Environment** IPFire 2.29 (x86_64), Core Update 204. **Problem** After enabling the julioliraup/Antiphishing IPS ruleset, Suricata reports three failed signatures because their datasets cannot be initialized. Affected signatures: - SID 6000000: AT DNS query to suspicious domain - Phishing - SID 6000001: AT TLS SNI to suspicious domain - Phishing - SID 6000002: AT IP dataset - Phishing **Observed errors (October 23, 2026)** ``` failed to set up dataset 'phishing_domains'. failed to set up dataset 'phishing_ips'. 25 rule files processed. 130124 rules successfully loaded, 3 rules failed, 0 rules skipped. ``` The rules file is present: ``` /var/lib/suricata/julioliraup_antiphishing-antiphishing.rules ``` However, searching `/var/lib/suricata` for the required `phishing.lst` and `phishing_ips.lst` files returns no results. The errors are reproducible across rule reloads (observed at approximately 01:24 and 13:24). **Expected behavior** The IPFire IPS ruleset updater should install the rules and all required dataset files so that all valid signatures can be loaded. **Possible cause** The upstream project distributes its rules together with additional datasets. The IPFire integration may be importing the rules file without installing the supplementary dataset files at the paths expected by Suricata. This is a hypothesis, not a confirmed root cause. **Impact** Three phishing-detection signatures are not loaded. The remaining signatures load successfully and the Suricata rule reload completes. **Upstream project** https://github.com/julioliraup/Antiphishing ** Log Snippet ** 01:24:14 suricata: [29437] <Info> -- tenant id 0: 129860 signatures processed. 21137 are IP-only rules, 3463 are inspecting packet payload, 105209 inspect application layer, 0 are decoder event only 01:24:14 suricata: [29437] <Info> -- tenant id 0: Threshold config parsed: 0 rule(s) found 01:24:14 suricata: [29437] <Info> -- tenant id 0: 25 rule files processed. 129858 rules successfully loaded, 3 rules failed, 0 rules skipped 01:24:10 suricata: [29437] <Error> -- error parsing signature "alert ip $HOME_NET any -> any any (msg:"AT IP dataset - Phishing"; ip.dst; dataset:isset,phishing_ips,type ipv4,load phishing_ips.lst; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000002; classtype:social-engineering; sid:6000002; rev:1; metadata: signature_severity Major, created_et 2026_08_14;)" from file /var/lib/suricata/julioliraup_antiphishing-antiphishing.rules at line 10 01:24:10 suricata: [29437] <Error> -- failed to set up dataset 'phishing_ips'. 01:24:10 suricata: [29437] <Error> -- error parsing signature "alert tls $HOME_NET any -> any any (msg:"AT TLS SNI to suspicious domain - Phishing"; tls.sni; dataset:isset,phishing_domains,type string,load phishing.lst; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000001; classtype:social-engineering; sid:6000001; rev:1; metadata: signature_severity Major, created_et 2025_02_19;)" from file /var/lib/suricata/julioliraup_antiphishing-antiphishing.rules at line 8 01:24:10 suricata: [29437] <Error> -- failed to set up dataset 'phishing_domains'. 01:24:10 suricata: [29437] <Error> -- error parsing signature "alert dns $HOME_NET any -> any any (msg:"AT DNS query to suspicious domain - Phishing"; dns.query; dataset:isset,phishing_domains,type string,load phishing.lst; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000000; classtype:social-engineering; sid:6000000; rev:1; metadata: signature_severity Major, created_et 2025_02_19;)" from file /var/lib/suricata/julioliraup_antiphishing-antiphishing.rules at line 6 01:24:10 suricata: [29437] <Error> -- failed to set up dataset 'phishing_domains'. 01:23:58 suricata: [29437] <Info> -- Including configuration file /var/ipfire/suricata/suricata-used-rulesfiles.yaml. 01:23:58 suricata: [29437] <Info> -- Including configuration file /var/ipfire/suricata/suricata-http-ports.yaml. 01:23:58 suricata: [29437] <Info> -- Including configuration file /var/ipfire/suricata/suricata-dns-servers.yaml. 01:23:58 suricata: [29437] <Info> -- Including configuration file /var/ipfire/suricata/suricata-homenet.yaml. 01:23:58 suricata: [29437] <Notice> -- rule reload starting
With IPFire-2.x the component should always be specified as --- This problem may have already been reported into the julioliraup by OPNsense. I have added the error messages found on IPFire into that issue report to see if it is the same problem or a separate one. https://github.com/julioliraup/Antiphishing/issues/13
Patch has been submitted by the julioliraup developer to create an IPFire specific rules tarball. https://lists.ipfire.org/development/01bc914c-1126-45b0-9534-1027aa39717a@ipfire.org/T/#t https://patchwork.ipfire.org/project/ipfire/patch/f850e96b9bf29cf9f36dfc1cbffa3a05@disroot.org/
I tested out the patch and forced an update. The previous errors are no longer shown but a new warning is found in the logs 21:17:18 suricata: [2316] <Warning> -- No rule files match the pattern /var/lib/suricata/julioliraup_antiphishing-antiphishing.rules I will feed this into the julioliraup github issue
I removed juliliraup as a provideer in the IPS WUI page and then re-added it and this time that warning message is no longer shown. I suspect that I needed to restart suricata after updating the ruleset-sources file. I will repeat my test to check that this is the case.