Bug 11316 - Enhancement: Logging should distinguish action DROP/ ACCEPT
Summary: Enhancement: Logging should distinguish action DROP/ ACCEPT
Status: NEW
Alias: None
Product: IPFire
Classification: Unclassified
Component: --- (show other bugs)
Version: 2
Hardware: all All
: Will affect most users Balancing
Assignee: Assigned to nobody - feel free to grab it and work on it
QA Contact:
URL:
Keywords: NewFeature
Depends on:
Blocks: FWBUGS
  Show dependency treegraph
 
Reported: 2017-04-13 16:58 UTC by ipf-tom
Modified: 2020-01-22 21:23 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description ipf-tom 2017-04-13 16:58:54 UTC
When adding a firewall rule with actopm "DROP" and logging active, it is translated into a iptables rule like:
LOG  all  --  my.orange.ip.net/24 0.0.0.0/0 limit: ... prefix "FORWARDFW "
DROP all  --  my.orange.ip.net/24 0.0.0.0/0

The log entry shown in the web interface does show the chain "FORWARDFW", but there is no indication, that the packet has been dropped. Of course I could know about my rules, but who do allways remember, what he configured a month ago?

It would be useful to add the action to the log also. For example:
LOG  all  --  my.orange.ip.net/24 0.0.0.0/0 limit: ... prefix "FORWARDFW:DROP "
Comment 1 Peter Müller 2018-02-06 20:57:26 UTC
Hm, this seems to be an aesthetic issue, isn't it?
Comment 2 ipf-tom 2018-02-07 10:58:17 UTC
(In reply to Peter Müller from comment #1)
> Hm, this seems to be an aesthetic issue, isn't it?

No, it isn't a aesthetic issue only.

While watching /var/log/messages I did see some FORWARDFW log entries for a request, which should be dropped. So I got frightened and started to analyse the iptables. After a while I've realized, that the log entry was a DROP.

-> The log entries are misleading and did cause scare and work.

And because the firewall rules are not versioned, you cannot analyze a firewall log from the past. You do dont know whether the packet has been forwarded if you do not know the rules for this specific time. It would be a big improvement for tracability if the log would document the action taken.

So IMHO it is a small change with a big win. Even for small environments like at home.