Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FIREHOL_LOG_PREFIX not applied to all log messages #494

Open
kb-elmo opened this issue Dec 13, 2023 · 0 comments
Open

FIREHOL_LOG_PREFIX not applied to all log messages #494

kb-elmo opened this issue Dec 13, 2023 · 0 comments

Comments

@kb-elmo
Copy link

kb-elmo commented Dec 13, 2023

When setting FIREHOL_LOG_PREFIX in the config file I still get several log line in the iptables file that are missing the prefix.
The prefix is only applied to some of the log config lines.

Example from /etc/iptables/rules.v4:

[0:0] -A INPUT -m conntrack --ctstate INVALID -m limit --limit 1/sec -j LOG --log-prefix "\"firehol: DROP INVALID INPUT:"
[0:0] -A INPUT -m limit --limit 1/sec -j LOG --log-prefix "\"firehol: DROP UNMATCHED IN-u"
[0:0] -A FORWARD -m conntrack --ctstate INVALID -m limit --limit 1/sec -j LOG --log-prefix "\"DROP INVALID FORWARD:\""
[0:0] -A FORWARD -m limit --limit 1/sec -j LOG --log-prefix "\"firehol: DROP UNMATCHED PASS"
[0:0] -A OUTPUT -m conntrack --ctstate INVALID -m limit --limit 1/sec -j LOG --log-prefix "\"firehol: DROP INVALID OUTPUT"
[0:0] -A OUTPUT -m limit --limit 1/sec -j LOG --log-prefix "\"firehol: DROP UNMATCHED OUT-"
[0:0] -A in_intern -m conntrack --ctstate INVALID -m limit --limit 1/sec -j LOG --log-prefix "\"firehol: DROP INVALID in_int"
[0:0] -A in_intern -m limit --limit 1/sec -j LOG --log-prefix "\"firehol: DROP UNMATCHED IN-i"
[0:0] -A in_public4 -m conntrack --ctstate INVALID -m limit --limit 1/sec -j LOG --log-prefix "\"DROP INVALID in_public4:\""
[0:0] -A in_public4 -m limit --limit 1/sec -j LOG --log-prefix "\"reject UNMATCHED IN-public4:"
[0:0] -A out_intern -m conntrack --ctstate INVALID -m limit --limit 1/sec -j LOG --log-prefix "\"firehol: DROP INVALID out_in"
[0:0] -A out_intern -m limit --limit 1/sec -j LOG --log-prefix "\"firehol: DROP UNMATCHED OUT-"
[0:0] -A out_public4 -m conntrack --ctstate INVALID -m limit --limit 1/sec -j LOG --log-prefix "\"DROP INVALID out_public4:\""
[0:0] -A out_public4 -m limit --limit 1/sec -j LOG --log-prefix "\"reject UNMATCHED OUT-public4"

This causes incoherent logging and makes it impossible to properly route the firehol logs into their own file with rsyslog.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant