snort inline mode configuration

[j4ck]

Hi,

I'm trying to run Snort in inline (IPS) mode. Here's my configuration file:

config daq: ipfw
config daq_mode: inline
config policy_mode: inline
output alert_full: stdout
include snort.rule

An here is the rule file:

drop tcp any any -> any 23 (msg: "Drop telnet packets"; sid: 1000001)
pass ip any any -> any any

I execute snort -c /root/snr.conf -Q --alert-before-pass. I expect the ICMP packets to pass and telnet packets to drop. But both packet types pass! Am I missing something?