Lots of blocks in log - any comments

SteveITS

@hspindel we always turn off logging of the default block rules. Eliminates a LOT of log noise, and disk writes.

johnpoz

@SteveITS said in Lots of blocks in log - any comments:

we always turn off logging of the default block rules.

Same here - I only log tcp syn directed to my wan IP, and then common udp ports. Just for curiosity really to see what ports might be trending at the moment ;)

hspindel

Thank you for the informative response.

@johnpoz said in Lots of blocks in log - any comments:

If your not able to use dhcpv6 with your isp, set your wan interface to none for IPv6

That's the setting I missed -TYVM!

hspindel

@johnpoz said in Lots of blocks in log - any comments:

Same here - I only log tcp syn directed to my wan IP, and then common udp ports. Just for curiosity really to see what ports might be trending at the moment ;)

#johnpoz: Do you setup a new WAN firewall rule that overrides the default block in order to log tcp syn? Would you mind sharing the rules you set up?

Thank you.

johnpoz

@hspindel Just turn off default logging, and then here is what I have on wan

hspindel

@johnpoz Thank you very much for the rules. Seem to be working fine for me.

CZvacko

I'm also looking way how to solve firewall log noise (for IPV6), but want to keep ON logging of the default block rules.

I was trying to create block rules (with "Log packets" disable) to eliminate related records, but they keep appear.

I know there are hidden implicit rules, but they should be evaluated last, isnt it ? So when packet reach my own rule, should be blocked accordingly (and not logged). Or I dont understand it corectly ?

johnpoz

@CZvacko said in Lots of blocks in log - any comments:

I know there are hidden implicit rules, but they should be evaluated last,

Not when you click the BLOCK all IPv6 checkbox.. Or uncheck it if you will, if you don't want IPv6 noise, then allow IPv6, just don't create any allow rules.. Any noise then blocked by the default deny which is last, you can create rules above that do not log.

You can put in a feature request that if your blocking all ipv6, you should be able to not log it specific, but right now its tied to the log default deny.. When you uncheck the allow IPv6, it creates specific rules

# Block all IPv6
block in log quick inet6 all ridentifier 1000000003 label "Block all IPv6"
block out log quick inet6 all ridentifier 1000000004 label "Block all IPv6"

If you allow it then those rules are not created, and if you just do not allow it, you can put in rules to not log it which are above the normal default deny rules

If you allow it, you could then create your own rules in floating just like the above that are auto created, but not put in the log part.

You could put in a feature request, that allows not logging when you block IPv6, maybe like the log settings that allow you not to log the bogon or rfc1918 rules.

I always thought it was a bit odd you couldn't do something like that, but then again I allow IPv6 and don't even log default deny - so never an issue for me..

CZvacko

@johnpoz
I think I understand it now, implicit/hidden firewall rules are generally evaluated last, but if the Allow IPv6 checkbox is enabled, implicit/hidden IPv6 rules are evaluated first (so other IPv6 rules from the user are not reachable).

johnpoz

@CZvacko said in Lots of blocks in log - any comments:

implicit/hidden firewall rules are generally evaluated last

No not the case at all.. For example there are hidden rules for dhcp, etc.. Yes the default deny rule is last..

If you explicit say block IPv6 by unchecking that box, then yes those are first.. How could that sort of rule not be first, you might have created rules that allow IPv6.. And since there is a default deny at the end any way for both ipv4 and ipv6.. Then yes wanting block all IPv6 would have to be first on the list.