No log entries

michmoor

I noticed that connections regardless if they are permitted or denied, are not showing up in the firewall logs under Normal or Dynamic View.
Interestingly enough, when checking states, i do see it there.

I was in the process of tshooting a wireguard client install so i wanted to see traffic logs from my local machine to the remote. Putty gave me a connection timed out. I am checking the firewall logs and i do not see the connection attempts there. Odd. Perhaps the connections are queued up so i would have to wait a few seconds but after a few minutes, i still dont see my logs. Lucky enough it turned out to be an iptables issues on the remote end but after i initiated an SSH session , i still didnt see any log entries.
For what its worth i am seeing log entries for other rules.

johnpoz

@michmoor said in No log entries:

For what its worth i am seeing log entries for other rules.

Did you set your rule to log? Out of the box only default deny is logged in the firewall log. If you create some allow rule for something, it wouldn't be logged unless you stated it to do so.

Even if you created a specific rule, and set it to log - its possible some other rule actually is the one to allow the traffic, and it is not set to log, etc.

michmoor

@johnpoz there is one rule, permit any, and it’s set to log. I do see logs matching this rule (and interface) so that’s what stood out to me the fact that a specific flow isn’t being logged

johnpoz

@michmoor You only have the 1 default lan any any rule?

No floating rules?

You sure you just didn't miss it, by default only like 50 entries are shown in the log. And logging on a allow only logs the first entry, when the state is created. If followup connections are made and the state is there there would be nothing logged, because the connection is allowed by the state.

If you want to see it log again, you would need to kill any existing states. And you prob want to increase what is shown in the logs. I have mine set to 2000 (max) for example.

stephenw10

Also check for rules on interface groups which are easy to overlook.

If you run at the command line: pfctl -vss
You can see the rule number that opened a state.
Then you can check which rule that was using: pfctl -vvsr

Steve

michmoor

@johnpoz Floating rules yes, but not for the Interface in question - Wireguard

michmoor

@stephenw10 said in No log entries:

mber that opened a state.
Then you can check which rule that was using: pfctl -vvs

got it. ill do some testing today and report back.