Logging all inbound and outbound traffic with firewalld direct rules
This document (000020833) is provided subject to the disclaimer at the end of this document.
Environment
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15 SP3
Situation
This document details how to enable the logging of all inbound and outbound traffic using firewalld direct rules.
Resolution
Pre-requisites
Rule to log all incoming traffic setting log level to 4:
firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix "INPUT " --log-level 4
Rule to log all outgoing traffic setting log level to 4:
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -p all -s 192.168.1.10 -j LOG --log-prefix "OUTPUT " --log-level 4
With nftables as backend, direct rules are given a higher precedence than all other firewalld rules.
To check if the rules are applied:
firewall-cmd --direct --get-all-rules
To make the rules permanent:
firewall-cmd --runtime-to-permanent
To list all direct permanent rules:
firewall-cmd --direct --get-all-rules --permanent
Traffic logs are written in /var/log/firewall
- firewalld.service must be started.
Rule to log all incoming traffic setting log level to 4:
firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix "INPUT " --log-level 4
Rule to log all outgoing traffic setting log level to 4:
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -p all -s 192.168.1.10 -j LOG --log-prefix "OUTPUT " --log-level 4
With nftables as backend, direct rules are given a higher precedence than all other firewalld rules.
To check if the rules are applied:
firewall-cmd --direct --get-all-rules
To make the rules permanent:
firewall-cmd --runtime-to-permanent
To list all direct permanent rules:
firewall-cmd --direct --get-all-rules --permanent
Traffic logs are written in /var/log/firewall
Additional Information
Reference:
- Firewalld direct rules man pages - https://firewalld.org/documentation/man-pages/firewalld.direct.html
- Nftables backend man pages - https://firewalld.org/2018/07/nftables-backend
Disclaimer
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:000020833
- Creation Date: 28-Oct-2022
- Modified Date:01-Nov-2022
-
- SUSE Linux Enterprise Server
- SUSE Linux Enterprise Server for SAP Applications
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com
