Packets go through, logging is set, but no logs of the traffic

silviub

Hello,

I got a bit of a weird one:
I've got a NAT rule to forward port 1194/UDP traffic on a specific public IP to an internal IP. The rule is set to log "Log packets that are handled by this rule" packets that are handled by this rule.
Under Diagnostics -> States -> States I see traffic passing through, and matching this rule (filtered by rule ID and I see traffic)
If I go to Status -> System Logs -> Firewall, there's no entry of that traffic.

What's going on ?!

Thank you!

stephenw10

It will only log when a new state is opened. An OpenVPN connection like that could be open for months so it's possible any states you see were created before you enabled logging?

Gertjan

@silviub said in Packets go through, logging is set, but no logs of the traffic:

What's going on ?!

You were close

Added to what stephenw10 said, go here : Diagnostics > States > States and check the "State Table" box.
Then go for the orange Reset button.
A side effect exists : you also 'kill' your connection the the GUI.
You'll actually kill the connection for everybody ^^

silviub

@stephenw10
I appreciate the reply, but there isn't really any client here. It's just me, running nc -u <ip> 1194 and sending some data, therefore the connections are always "new".
@Gertjan as I said, this is not really (yet) alive, because I'm just testing stuff out. But I had clients connect and disconnect and I didn't see them in the logs, so I started to manually test.

Any way to log ALL connections, not just new connections? Maybe....?
Any other ideas?

stephenw10

Ok, so to confirm you see states and packets on the rule as shown in the gui?

Try reloading the ruleset in Status > Filter Reload and make sure it loads cleanly without errors.

silviub

@stephenw10 Yes, I can see the states and packets next to the rule.
The firewall loads with no issues, just did it.

Nothing changed.

stephenw10

Hmm, OK. Check the actual ruleset in /tmp/rules.debug. Do you see your custom rule? Does it have 'log' set?

silviub

@stephenw10
pass in log quick on $WAN reply-to ( vtnet0 a.b.c.d ) inet proto udp from any to 10.151.0.5 port 1194 ridentifier 1702983321 keep state label "USER_RULE: OpenVPN" label "id:1702983321"

Yes, it seems to have the log stanza (pass in log quick).

chpalmer

@silviub said in Packets go through, logging is set, but no logs of the traffic:

but there isn't really any client here

Just a refresher coarse.. client device requests... server listens and grants. rinse and repeat.

Very basic.. Cant have a connection between two computers without that.

Carry on.

silviub

@chpalmer while you're technically right, I was replying to stephenw10, who said

An OpenVPN connection like that could be open for months so it's possible any states you see were created before you enabled logging?

So, in that regard, there wasn't a VPN client that kept the connections open. Please read above.