Logging all packets in firewalld

firewalldlogging

We're trying to configure firewalld to log all incoming packets. So far I've only managed to log only rejected packets with LogDenied=off that shows:

 FINAL_REJECT: IN=eth0 OUT= MAC=00:dd:3a:26:18:2d:dd:34:5f:78:9a:bc:ff:00 SRC=65.13.35.231 DST=10.0.1.5 LEN=48 TOS=0x00 PREC=0x00 TTL=102 ID=31984 DF PROTO=TCP SPT=49886 DPT=3385 WINDOW=8192 RES=0x00 SYN URGP=0

But I need to log accepted packets as well. Is there any option to do that?

Best Answer

You can tag any rule with a prefix to identify accepted rules:

firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.20.0.0/16 port port=1234 protocol=tcp log prefix="MyTagHere " level=info accept'

Related Solutions

UFW logs blocked request on open port, what am I missing

Notice that your packet has both the FIN and ACK bits set. This is the last packet that the remote host sends in the TCP tear down (end of connection) procedure.

What happens is, when your host has finished sending it sets the FIN and ACK flags on the last packet. The remote hosts sends a packet with ACK set followed by a packet with FIN and ACK set.

Local          remote
FIN ACK ---->
        <----  ACK
        <----  FIN ACK (?optional?)
ACK     ----->

In practice, the remotes FIN ACK is considered optional so the netfilter firewall will flush it's connection table when it sees the ACK so when the FIN ACK packet arrives it has no associated connection and is dropped.

Iptables: How to read this OPT string

0204057D010303010101080A3E521D4D0000000004020000
From a sans.org study guide,
the first 2 bytes (0x0204) 04--is-length 02 means MSS flag
the next 2 bytes (0x057D) are the value for maximum size segment (MSS)
the next byte (0x01) is a no-op
the next 2 bytes (0x0303) indicate a windows scaling is enabled

the 3 bytes ("010101") are no-ops (AKA padding)
the 2 next bytes ("080a") flag a time stamp value
the 4 next bytes (("0x3E521D4D00000000") are date time 5 * 2 bytes
the 4 next bytes ("0402") sAck Ok

The master document: ftp://ftp.ietf.org/iana/tcp-parameters/tcp-parameters.xml
Others: https://datatracker.ietf.org/doc/html/draft-ietf-tcpm-tcp-security-03
http://www.ietf.org/mail-archive/web/tcpm/current/msg03199.html

for humor! : https://www.rfc-editor.org/rfc/rfc5841

Best Answer

Related Solutions

UFW logs blocked request on open port, what am I missing

Iptables: How to read this OPT string

Related Topic