Join Log in
Score:0
avatar Server

firewalld: logging of blocked outgoing connections

in flag
Steffen

I have configured firewalld so that the firewall will blockes also outgoing connections. The outgoing traffic I need I have white listed by adding specific rules. This works fine.

But now I want to know, if there are outgoing connections which are currently still blocked by firewalld. To check this I have set LogDenied to all and restart/reload firewalld. Now I can see many firewalld message in /var/log/messages for REJECTed incomming messages like

Mar  5 19:45:29 kvm011 kernel: FINAL_REJECT: IN=br0-enp3s0 OUT= MAC=80:ee:73:9d:59:09:98:9b:cb:bf:c3:7e:08:00 SRC=192.168.1.254 DST=192.168.1.3 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=55873 DF PROTO=TCP SPT=41047 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0

But it seems, that blocked outgoing traffic will be not logged. I have test it: The SMTP port 25 is not white listed for outgoing traffic. So if I try to send an email, the email is marked as ''deferred'' and I see in maillog that the email cannot send:

Mar  5 19:46:21 kvm011 postfix/smtp[3240]: connect to xxx.xxx.org[193.111.xxx.xxx]:25: Connection timed out

But there is no firewalld message in the /var/log/messages file (for the blocked connection on port 25). Must I activate these kind of messages in firewalld? If so, how can I do that?

136
0 + 0
Score:1
avatar Server
in flag
Steffen

Found it! I must add explicit a rule to enable logging for outgoing blocked connections:

firewall-cmd --direct --permanent --add-rule ipv4 filter OUTPUT 1 -j LOG --log-prefix \"FINAL_REJECT: \" --log-level 4

After reload or restart firewalld I get my expected logs like:

 Mar  6 11:56:01 kvm011 kernel: FINAL_REJECT: IN= OUT=br0-enp3s0 SRC=192.168.1.3 DST=193.111.xxx.xxx LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=59572 DF PROTO=TCP SPT=57134 DPT=25 WINDOW=29200 RES=0x00 SYN URGP=0
0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.