Daily firewall reports



  • Hello everyone,

    I am replacing a set of Linux based firewalls with PF boxes and can do most everything I need to with the PF boxes save a few.

    The big one right now is I need to be able to produce a daily list of firewall activity such as dropped/rejected packets per interface as well was statistical break down of packets per interface. Management has gotten used to a daily emailed Logwatch report so reporducing that or something similar would be great. A package would be totally awesome of course, :)

    Does anyone have any thoughts on that or experience setting Logwatch up? I have tried to do the remote syslog thing but no tool I used seem to work well with the log output.

    Thanks for any help in advance!

    Rich


  • Rebel Alliance Developer Netgate

    There's an open ticket to do something like this, but it will have to wait until after 2.0 is released.

    I have some ideas on what to do, but no code yet.

    What kind of statistics are you used to seeing? Do you have a sample report? (with anything identifying removed, of course)



  • Thanks for the reply!

    Here is some samples from the report management is used to seeing:

    Listed by source hosts:
    Accepted 45 packets on interface eth1
      From XXX.XXX.XXX.XXX - 1 packet to udp(123)
      From XXX.XXX.XXX.XXX - 70 packets to udp(53,123) tcp(22)
      From XXX.XXX.XXX.XXX - 168 packets to udp(123)
      From XXX.XXX.XXX.XXX - 25 packets to udp(123)

    Listed by source hosts:
    Dropped 105 packets on interface eth0
      From X.X.X.X - 1 packet to udp(5060)
      From X.X.X.X - 1 packet to udp(5060)
      From  X.X.X.X- 16 packets to tcp(18490)
      From X.X.X.X - 2 packets to tcp(445)
      From X.X.X.X - 1 packet to udp(1434)
      From X.X.X.X - 1 packet to udp(1434)
      FromX.X.X.X - 1 packet to tcp(3306)

    Listed by source hosts:
    Logged 1181 packets on interface eth1
      From XXX.XXX.XXX.XXX - 98 packets to tcp(80)
      From XXX.XXX.XXX.XXX - 255 packets to tcp(80)
      From XXX.XXX.XXX.XXX - 21 packets to tcp(80)
      From XXX.XXX.XXX.XXX - 34 packets to tcp(80)
      From XXX.XXX.XXX.XXX - 36 packets to tcp(80)
      From XXX.XXX.XXX.XXX - 30 packets to tcp(80)

    Listed by source hosts:
    Rejected 12 packets on interface eth0
      From XXX.XXX.XXX.XXX - 1 packet to udp(123)
      From XXX.XXX.XXX.XXX - 1 packet to tcp(22)
      From XXX.XXX.XXX.XXX - 1 packet to udp(43361)
      From XXX.XXX.XXX.XXX - 1 packet to tcp(2967)
      From XXX.XXX.XXX.XXX - 1 packet to tcp(22)
      From XXX.XXX.XXX.XXX - 3 packets to tcp(30978)

    Listed by source hosts:
    Rejected 855 packets on interface eth1
      From XXX.XXX.XXX.6 - 15 packets to tcp(443)
      From XXX.XXX.XXX.58 - 3 packets to icmp(8)
      From XXX.XXX.XXX.59 - 15 packets to tcp(443)
      From XXX.XXX.XXX.61 - 120 packets to tcp(443)
      From XXX.XXX.XXX.67 - 15 packets to tcp(443)
      From XXX.XXX.XXX.70 - 50 packets to tcp(443,1935)
      From XXX.XXX.XXX.71 - 60 packets to tcp(443,1935)

    Hope this helps.

    Any idea when we will see 2.0? I have been loving 1.2.3 and love the new stuff in 2.0 especialy the key managment for openvpn.

    Thanks again!!

    Rich


Log in to reply