6

I am using Firewalld and the drop zone is the default zone with an interface assigned to the zone.

I then have rich rules to allow some traffic through the drop zone and I have enabled firewall-cmd --set-log-denied=all. I would of thought that this would log anything that attempts to connect to the server that doesn't come from the white-listed rich rule... but it won't log. I ran port scans against the server and the /var/log/messages doesn't show any of the denied ports logs.

However when I set the default zone to public and assign the interface to public, it does log denied packets when I run another port scan.

Why?

Improve this question
1
  • I noticed this question has been viewed a lot of times but there was no answer. However I can say I resolved the issue by updated to the latest release of Firewalld. The package version I was on at the time had a bug.
    – Matt B
    Jul 3, 2018 at 9:50

2 Answers 2

Reset to default
6

The problem seems to be related to a bug as said in the comment. However, for those who are still having trouble to get the logging of firewall denial packets, the following approach worked for me:

The following worked with firewalld + rsyslogd

Edit /etc/sysconfig/firewalld and update the value for LogDenied to all (or as required)

LogDenied=all

restart firewalld

sudo systemctl restart firewalld

Alternatively, using the command line, one can execute the following command:

sudo firewall-cmd --set-log-denied all

This typically adds logging rules just before reject/drop rules in the firewall, something like:

LOG  all  --  anywhere   anywhere  LOG level warning prefix "IN_drop_DROP: "
LOG  all  --  anywhere   anywhere  LOG level warning prefix "FINAL_REJECT: "

Create a file named /etc/rsyslog.d/custom_iptables.conf and add the following statements to it:

:msg,contains,"_DROP" /var/log/iptables.log
& stop
:msg,contains,"_REJECT" /var/log/iptables.log
& stop

restart rsyslog

sudo systemctl restart rsyslog

Now the dropped and rejected packets will be logged to /var/log/iptables.log

Improve this answer
2
  • Please follow as advised by #kondor6c in one of the answers.
    – VanagaS
    Jan 26, 2020 at 4:34
  • 1
    In your custom_iptables.conf, you will likely also want to add a & stop line after the "_DROP" line, not just after the "_REJECT" line. A & stop line only applies to the one line immediately above it. As it's currently written, "_DROP" messages will get double-logged to both the iptables.log file and the main system log.
    – ven42
    Feb 22, 2021 at 21:25
4

Awesome job, this helped me go down the right path, I appreciate the post.

The only thing I noticed is that I believe that the location for LogDenied=all should be /etc/firewalld/firewalld.conf since /etc/sysconfig/firewalld is for startup command line options. Additionally the file for rsyslog might be better named with a .conf, sometimes default include statements might not look for a .log file.

Really good job VanagaS!

ref: https://firewalld.org/documentation/man-pages/firewalld.conf.html

Improve this answer
1
  • Thank you for the heads up!
    – VanagaS
    Jan 26, 2020 at 4:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .