6

I am using Firewalld and the drop zone is the default zone with an interface assigned to the zone.

I then have rich rules to allow some traffic through the drop zone and I have enabled firewall-cmd --set-log-denied=all. I would of thought that this would log anything that attempts to connect to the server that doesn't come from the white-listed rich rule... but it won't log. I ran port scans against the server and the /var/log/messages doesn't show any of the denied ports logs.

However when I set the default zone to public and assign the interface to public, it does log denied packets when I run another port scan.

Why?

1
  • I noticed this question has been viewed a lot of times but there was no answer. However I can say I resolved the issue by updated to the latest release of Firewalld. The package version I was on at the time had a bug.
    – Matt B
    Jul 3, 2018 at 9:50

2 Answers 2

5

The problem seems to be related to a bug as said in the comment. However, for those who are still having trouble to get the logging of firewall denial packets, the following approach worked for me:

The following worked with firewalld + rsyslogd

Edit /etc/sysconfig/firewalld and update the value for LogDenied to all (or as required)

LogDenied=all

restart firewalld

sudo systemctl restart firewalld

Alternatively, using the command line, one can execute the following command:

sudo firewall-cmd --set-log-denied all

This typically adds logging rules just before reject/drop rules in the firewall, something like:

LOG  all  --  anywhere   anywhere  LOG level warning prefix "IN_drop_DROP: "
LOG  all  --  anywhere   anywhere  LOG level warning prefix "FINAL_REJECT: "

Create a file named /etc/rsyslog.d/custom_iptables.conf and add the following statements to it:

:msg,contains,"_DROP" /var/log/iptables.log
& stop
:msg,contains,"_REJECT" /var/log/iptables.log
& stop

restart rsyslog

sudo systemctl restart rsyslog   

Now the dropped and rejected packets will be logged to /var/log/iptables.log

2
  • Please follow as advised by #kondor6c in one of the answers.
    – VanagaS
    Jan 26, 2020 at 4:34
  • 1
    In your custom_iptables.conf, you will likely also want to add a & stop line after the "_DROP" line, not just after the "_REJECT" line. A & stop line only applies to the one line immediately above it. As it's currently written, "_DROP" messages will get double-logged to both the iptables.log file and the main system log.
    – ven42
    Feb 22, 2021 at 21:25
4

Awesome job, this helped me go down the right path, I appreciate the post.

The only thing I noticed is that I believe that the location for LogDenied=all should be /etc/firewalld/firewalld.conf since /etc/sysconfig/firewalld is for startup command line options. Additionally the file for rsyslog might be better named with a .conf, sometimes default include statements might not look for a .log file.

Really good job VanagaS!

ref: https://firewalld.org/documentation/man-pages/firewalld.conf.html

1
  • Thank you for the heads up!
    – VanagaS
    Jan 26, 2020 at 4:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.