Your issue is the line with HTTP_SERVERS: "!$HOME_NET.
There are several rules in the ET ruleset that start with alert http any any -> [$HTTP_SERVERS,$HOME_NET] .......
That will not work when HTTP_SERVERS are set to be not HOME_NET.
I would recommend just setting HTTP_SERVERS to HOME_NET or removing all rules using HTTP_SERVERS.
1 Like