Logging IP packets to a PostgreSQL/MySQL database, compatable to ulog+iptables

Grub3 · Mar 4, 2011, 8:11 AM

Dear all,

I am migrating my Iptables GNU/Linux firewall to pfSense. ;D

In GNU/Linux, I am using ulog to log IP packets to a PostgreSQL database.
This is very interesting to keep trace of traffic for analysis of attacks.

Does pfSense offer some kind of ulog for database logging?

Kind regards,
Grub3

jimp · Mar 4, 2011, 1:54 PM

I'm not familiar with that particular method, but it sounds like you want netflow (pfflowd, softflowd, etc).

Grub3 · Mar 4, 2011, 2:04 PM

Interesting, I did not know netflow.
This seems very traffic oriented.

I am using ulogd for security and traceability.

Ulogd allows logging of packets on request.
This is done when programming firewalling rules.
Some tools like fwbuilder supports ulogd by default.

You can query the IP traffic using SQL queries, which is very convenient.

ulogd:
http://www.netfilter.org/projects/ulogd/index.html

Kind regards,

Grub3 · Mar 4, 2011, 2:08 PM

Being said differently, how can log rejected packets without syslog.
syslog is powerfull but too difficult to query.
I would like to be able to query rejected packets very easily.

Kind regards,

jimp · Mar 4, 2011, 4:08 PM

Syslog is the only way to do it out of the box. I'm not sure if anyone has a package out there that does what you're after.

You could write your own daemon that attached to the pflog device and reads the data (or pipe it through tcpdump, check out how the current log is taken with tcpdump.) and then work that into your database however you like.