Log packets that are handled by this rule



  • Hello everyone,

    Something with the rule logging ( VER: Thu Mar 28 00:48:46 EDT 2013 )

    I set a very last rule with "block any" and log enabled …. I do see in "firewall" log section traffic blocked, during to set TCP connection, it fail.
    Next step I reverse the rule make it "PASS" and I do NOT see traffic logged by this rule in log section, during the same TCP connection attempts with success ( assuming it should appear as a green sign as opposed to blocked traffic with the red sign) I only see "green" as a broadcast 0:0:0:0 traffic

    Do I understand it correctly: this is a bug ?



  • Almost certainly not a bug, rule logging works fine and hasn't changed in ages, it's matching some other rule I suspect. Check /tmp/rules.debug for log in the corresponding rule.



  • Can you please give me more extended advise to debug it,

    I did try the same on 1.2.3 version and indeed the behavior is different. 1.2.3 shows ALL traffic blocked or passed:

    rule set as Passed:
    rule 65/0(match): pass in on em2: (tos 0x0, ttl 127, id 19189, offset 0, flags [+], proto UDP (17), length 1500) 10.2.2.5.500 > 10.5.3.10.500: isakmp 1.0 msgid : phase 1 ? ident:

    same rule set as Blocked:
    rule 65/0(match): block in on em2: (tos 0x0, ttl 127, id 19627, offset 0, flags [+], proto UDP (17), length 1500) 10.2.2.5.500 > 10.5.3.10.500: isakmp 1.0 msgid : phase 1 ? ident:

    I DO NOT see the same behavior on 2.1



  • 1.2.3 and 2.1 are no different in this regard. New connections that match a rule with logging enabled are logged.


Log in to reply