1

Is there a way to make UFW log changes made to firewall rules over time?

I have some automated tooling that temporarily blocks IP addresses from time to time and there seems to be a foot-gun in there somewhere that might be accidentally removing the rule for allowing port 22 (IPv4) traffic into the system, which is a little inconvenient when it happens! I'd like to get a list of rule changes made to try to isolate the problem.

1 Answer 1

1

You can monitor the Netlink socket family using nlmon interface.

sudo modprobe nlmon
sudo ip link add type nlmon
sudo ip link set nlmon0 up
sudo tcpdump -i nlmon0

You can use Wireshark to analyze in details the communication between iptables and Linux kernel using nlmon and filter what you are interested.

Here is how such frame looks decoded by Wireshark:

Frame 26: 36 bytes on wire (288 bits), 36 bytes captured (288 bits) on interface nlmon0, id 0
Linux netlink (cooked header)
    Link-layer address type: Netlink (824)
    Family: Netfilter (0x000c)
Linux netlink netfilter protocol
    Netlink message header (type: 0x0a10)
        Length: 20
        Message type: Protocol-specific (0x0a10)
        Flags: 0x0001
            .... .... .... ...1 = Request: 1
            .... .... .... ..0. = Multipart message: 0
            .... .... .... .0.. = Ack: 0
            .... .... .... 0... = Echo: 0
            .... .... ...0 .... = Dump inconsistent: 0
            .... .... ..0. .... = Dump filtered: 0
        Sequence: 0
        Port ID: 0
    0000 1010 .... .... = Subsystem: Netfilter tables (10)
    Data (4 bytes)
        Data: 00000000
        [Length: 4]

Using Scapy Python library, you can write a rapid packet parser.

2
  • Thanks... that's an interesting approach to say the least, though I am not certain what type of packets would be flowing internally that would reflect when a rule is added or removed from UFW. The other problem I have with this is that it could be several months between incidents of the problem. I don't want to have a packet trace running permanently on a production system for the sake of this - I am just looking for UFW to generate a log entry somewhere for me.
    – John Rix
    Commented Jun 12 at 8:13
  • On a machine that doesn't have many route changes (no dynamic routing like BGP, OSPF), and for which there are also few firewall rule changes, listening on nlmon interface will not affect the performance. Using Wireshark you can decode the rules, then select what you are interested. You can filter at capture time with a pcap filter, or later in your application. Commented Jun 13 at 21:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .