ufw

please add NFLOG support

Bug #1475676 reported by Jamie Strandboge
54
This bug affects 10 people
Affects Status Importance Assigned to Milestone
ufw
Wishlist
Unassigned

Bug Description

From https://bugs.launchpad.net/ufw/+bug/1294544/comments/19:
"I have the very same issue on a Banana Pi with kernel 3.19; the reason is that the kernel has no support for LOG but only for NFLOG. To work around this use 'ufw logging off && ufw enable'.
It would be great to get NFLOG support. Changeing LOG to NFLOG and --log-prefix to --nflog-prefix should suffice. Adding runtime detection would be great! ;-)"

Revision history for this message
Christian Kujau (christiank) wrote :

With bug #728128 being fixed (in ufw 0.35), this can be worked around as follows, for simple setups at least:

 $ cd /etc/ufw
 $ sudo sed 's/-j LOG --log-prefix/-j NFLOG --nflog-prefix/' -i.bak user.rules
 $ sudo sed 's/-j LOG --log-prefix/-j NFLOG --nflog-prefix/' -i.bak user6.rules

Revision history for this message
PabloAB (pabloab777) wrote :
Revision history for this message
Shuhao (shuhao) wrote :

Workaround in #1 doesn't work. UFW seems to just override the changes when it's enabled/disabled.

Revision history for this message
TomvB (tomvb) wrote :

With LXD it is important to fix:

 $ cd /etc/ufw
 $ sudo sed 's/-j LOG --log-prefix/-j NFLOG --nflog-prefix/' -i.bak user.rules
 $ sudo sed 's/-j LOG --log-prefix/-j NFLOG --nflog-prefix/' -i.bak user6.rules

Please add NFLOG support.
Unprivileged containers don't have a /dev/kmsg device and access to /proc/kmsg is blocked by the kernel.

### LOGGING ###
-A ufw-after-logging-input -j NFLOG --nflog-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
-A ufw-after-logging-forward -j NFLOG --nflog-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
-I ufw-logging-deny -m conntrack --ctstate INVALID -j RETURN -m limit --limit 3/min --limit-burst 10
-A ufw-logging-deny -j NFLOG --nflog-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
-A ufw-logging-allow -j NFLOG --nflog-prefix "[UFW ALLOW] " -m limit --limit 3/min --limit-burst 10
### END LOGGING ###

### RATE LIMITING ###
-A ufw-user-limit -m limit --limit 3/minute -j NFLOG --nflog-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-limit -j REJECT
-A ufw-user-limit-accept -j ACCEPT
### END RATE LIMITING ###

How can I replace the rules in after.rules?

Changed in ufw:
importance: Wishlist → Medium
Revision history for this message
TomvB (tomvb) wrote :

There is no workaround? Any time indication for the wishlist?

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

In terms of workarounds, could monkey patch the source for this in the container, or do the sed whenever ufw overwrites the changes.

Obviously both are unsatisfactory, so but I bumped the priority to medium. The time frame won't be immediate, but I'm going to try to fold this in with other work that is pending for this development cycle.

Revision history for this message
TomvB (tomvb) wrote :

Thank you Jamie! I will keep an eye on it.

Revision history for this message
TomvB (tomvb) wrote :

Hi Jamie,

Any updates about this feature to allow NFLOG? Would be awesome in combination with CSF or Fail2ban.

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

As this is a feature request, it is better listed as Wishlist. At this point NFLOG support would be nice, but there has been no progress.

TomvB, I can say since you mentioned fail2ban, you might be interested in the 'ufw prepend' command in ufw 0.36 which is much friendlier with fail2ban than insert.

Changed in ufw:
importance: Medium → Wishlist
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers