There are messages about a host in BLUE.
Chain: INPUTFW
Iface: blue0
Proto: UDP
Source: 192.168.103.23
Destination: 192.168.103.2
Src Port: 1030
Dest Port: 53 (Domain)
Dest. and Port are correct. Looks like the request was allowed and answered from the local DNS.
Is there a log to get info about the DNS request? Or do I have to catch the traffic via tcpdump?
The DNS logs are in Logs - System Logs then in the drop down box labelled Section: select Domain Name System.
Woow, thx. Indeed there are some enrties.
But none of them is related to the timestamp of the log entry in the FW-Log.
10:48:30 kresd[3581]: [rules ] => local data applied, user: 192.168.5.101, name: cloudflare-dns.com.
OK, 1st column is the timetamp
2nd column is the process incl. PID
3rd column in the [ ] is … the source of the log entry? What means rules?
the tailing part (local data applied) means what?
and then host …5.101 ask for cloudfare-dns.com?
This makes no sense … the …5.101 knows that the ipfire is the DNS …
This makes sense! .5.101 is told to use IPFire, but the device can not be urged to use this information. I suppose the log message documents such a ‘independent’ action.
The DBL suppresses this by giving answer “not known”.
The problem I see is that the applied category does not appear in the Log.
10:48:30 kresd[3581]: [rules ] => local data applied, user: 192.168.5.101, name: cloudflare-dns.com.
This line offers very little information. Only that a rule has been applied. Which one? It’s unknown.
Knot-resolver does not include the list name in its log output.
To change that then the knot-resolver developers would need to change their logging source code or someone using IPFire could create a patch file for the knot-resolver code and submit it to knot-resolver as a patch submission or as a pull request.
Currently what can be done is if you find an entry that you want to investigate to find which specific blocklist was involved, you can copy the name from the line in the log and put it into the Search DBL box at the top of the IPFire_DBL page and it will show in which list the entry was blocked.
