IPS in divert mode hold the session

[sun-k-c]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

A clear and concise description of what the bug is, including last known working version (if any).

Tip: to validate your setup was working with the previous version, use opnsense-revert (https://docs.opnsense.org/manual/opnsense_tools.html#opnsense-revert)

To Reproduce and Expected behavior
Sorry for English,
I add a rule in Rules[new], interface: LAN, Action: pass, Direction: In, Version: IPv4, Protocol: any, Source: LAN net, Divert-to: Intrusion Detection, other setting as default.
and then I tested "curl http://pkg.opnsense.org/test/eicar.com.txt" or use browser(Chrome) in LAN computer(Windows 10), IPS success block and show in IPS alert page. but browser and curl just hold and freeze in ten minute.
So I check Firewall: Diagnostics: States and testing many time as below:

Testing flow as below:

Run curl http://pkg.opnsense.org/test/eicar.com.txt, in LAN PC
and the program is freeze and no response, if run the url as Chrome browser same thing.

Firewall: Diagnostics: States
Dir ->, Source:computer IP, Destination: pkg.opnsense.org IP, State: ESTABLISHED:ESTABLISHED
Dir <-, Source:Firewall IP, Nat: computer IP, Destination: pkg.opnsense.org IP,State: ESTABLISHED:ESTABLISHED

after around 1 minute
Dir ->, Source:computer IP, Destination: pkg.opnsense.org IP, State: CLOSING:ESTABLISHED
Dir <-, Source:Firewall IP, Nat: computer IP, Destination: pkg.opnsense.org IP,State: ESTABLISHED:CLOSING

after around 1 minute
Dir ->, Source:computer IP, Destination: pkg.opnsense.org IP, State: FIN_WAIT_2:ESTABLISHED
Dir <- (disappared, successful timeout)

after around "10 minute"
Problem is in here, hold the TCP session in 10minute, and pkg.opsense.org server still in ESTABLISHED
Dir ->, Source:computer IP, Destination: pkg.opnsense.org IP, State:> TIME_WAIT:TIME_WAIT

after around 1 minute
Dir -> (disappered)
At the same time: curl (Unfreeze)
curl http://pkg.opnsense.org/test/eicar.com.txt
curl: (56) Recv failure: Connection was reset

A clear and concise description of what you expected to happen.

I think, the problem is IPS drop the connection, but firewall cannot make the server(pkg.opnsense.org) FIN_WAIT_2:FIN_WAIT_2 .
I expect file rules[new] -> rules can add a setting chose(reject/drop) the connection, when divert-to result is Drop, let client or server faster to release and release the state.

Environment
Hardware:
Intel® N150
Network Intel® i226-V(firmware 2.17-0) x 4 (1xWan, 3xLAN)
256 M.2. SSD
Software:
OPNsense 26.1_4-amd64, FreeBSD 14.3-RELEASE-p7
WAN IP: 192.168.14.104, LAN IP: 192.168.40.0/24
IPS Suricata 8.0, around 5.5K rules(Enabled), Pattern matcher: Hyperscan, Capture mode: Divert(IPS), Listeners: 4

[OPNsense-bot]

This issue has been automatically timed-out (after 180 days of inactivity).

For more information about the policies for this repository,
please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.

If someone wants to step up and work on this issue,
just let us know, so we can reopen the issue and assign an owner to it.