# Block rule logged as FORWARDFW

**URL:** <https://community.ipfire.org/t/block-rule-logged-as-forwardfw/10198>\
**Category:** Firewall Rules\
**Created:** [14 August 2023 13:21 UTC](https://community.ipfire.org/t/block-rule-logged-as-forwardfw/10198 "2023-08-14T13:21:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![svenf](https://community.ipfire.org/user_avatar/community.ipfire.org/svenf/32/10893_2.png) [@svenf](https://community.ipfire.org/u/svenf)\
**Post date:** [14 August 2023 13:21 UTC](https://community.ipfire.org/t/block-rule-logged-as-forwardfw/10198/1 "2023-08-14T13:21:20Z")

</div>

I have a drop rule for a single PC from green to red (internet). All attemps from this PC to the internet will logged in the firewall logs as “FORWARDFW”. Why? In my mind it should be logged as “DROP”.  
Core175

 ![image](https://community.ipfire.org/uploads/default/original/2X/e/e29702bc3950fe15e07d9ab8ce006a2cd6c1870a.png)  
 ![image](https://community.ipfire.org/uploads/default/original/2X/e/ef0c1d986c6f6fa1e3fbe3ac12b0447161931451.png)

---

<div class="post-metadata">

**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\
**Post date:** [14 August 2023 14:43 UTC](https://community.ipfire.org/t/block-rule-logged-as-forwardfw/10198/2 "2023-08-14T14:43:22Z")

</div>

> [@svenf](#):
>
> In my mind it should be logged as “DROP

The Linux firewall operates through a set of rules that inspect network packets to determine their fate. Generally, there are three primary actions: “Drop,” “Reject,” and “Accept.” If a packet doesn’t match a rule, it moves to the next one in the sequence. These rules are organized into chains, which are processed sequentially. Chains, in turn, are grouped into tables based on specific functions.

`FORWARDFW` is a chain, while `drop` is the action.

If you go in `Firewall/iptables` and in the first drop down menu you select and update the chain `FORWARDFW` you should see the rule, source, destination, target action, and the number of packets that have been inspected by that rule.

---

<div class="post-metadata">

**Author:** ![svenf](https://community.ipfire.org/user_avatar/community.ipfire.org/svenf/32/10893_2.png) [@svenf](https://community.ipfire.org/u/svenf)\
**Post date:** [14 August 2023 14:58 UTC](https://community.ipfire.org/t/block-rule-logged-as-forwardfw/10198/3 "2023-08-14T14:58:28Z")

</div>

And why is the action not logged?

---

<div class="post-metadata">

**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\
**Post date:** [14 August 2023 15:14 UTC](https://community.ipfire.org/t/block-rule-logged-as-forwardfw/10198/4 "2023-08-14T15:14:35Z")

</div>

This is just my hypothesis, as I am not an expert at all. If the logging mechanism were designed to log the action for every rule, the logs could quickly become voluminous and cluttered, especially for the commonly used ACCEPT action.