I really like the fantastic DROP Hostile feature. Unfortunately, it causes way too much noise in my firewall log…
Originally I thought this might be very simple but I can understand that it might be an unusual request.
My scenario is simple,
drop or block all INCOMING packets
-INCOMING from any country or any network, protocol, HOSTILE, friendly etc,…
block or drop bad OUTGOING traffic
-DROP hostile incoming or OUTGOING packets
-forward DNS and NTP requests to firewall.
keep the logs noise free so I can notice the really important entries.
I want to block everything possible but I don’t need to get notified 600 times per minute,
I am using
IPS / ET Community rules - ENABLED on RED and GREEN
Firewall Options - Drop packets from and to hostile networks (listed at [Spamhaus DROP] is OFF (because it is too noisy with 10+ identical entries per every second)
Location block is ENABLED + CHECKED Incoming traffic from this country will be blocked
Location block is CHECKED at XD Hostile networks safe to drop
IP Address Blocklists - ENABLED and subscribed to SPAMHAUS and most other blocklists
Firewall rules - NTP and DNS from IPfire Wiki
I documented the “noisy firewall log” a little while ago
The problem to getting round to it is purely the time availability. I had several other bugs on my list to work on and it took some time to be able to get round to it.
As you were the originator of that bug you should have got email notifications about the first patch submission made in Dec 2023 and the v2 version submitted 5 days ago based on a discussion in the Jan 2024 IPFire video call.
This patch should be able to get merged into CU183 or at the latest CU184.
Now I see that a whole new firewall option had to be created?
I thought there might be just an iptables switch or maybe a combination of Location block - I noticed there is a country called XD -Hostile networks safe to drop
If I understand correctly all the country blocks basically supposed to “filter out” all the entries from incoming firewall log.s.
Since there might be someone like me who drops all incoming packets
and it only makes sense to log Outgoing traffic,
I was thinking about making a Firewall rule like this:
Outgoing Firewall rule to log and drop Hostile traffic., would this work or make any sense?
I am not very familiar with the iptables rules sequences in IPFire but looking in the code if the DROP_HOSTILE option in the Firewall Options page is not selected then no action is taken on any packets from hostile networks.
Then you could create your rule for outgoing traffic and it would only drop and log the outgoing traffic.
Your incoming hostile traffic would be dropped anyway because you have no port forwards to open anything up from outside.
So I believe the rule should work if the drop hostile option is disabled in the firewall options WUI page. However it would be good for input from other people on my interpretation.
Your question is basically asking to have all hostile dropped, both incoming and outgoing but only log the outgoing which in situations as yours makes sense.
I have had a quick look at the code and I believe with some additional changes I can change the patch submission to allow to have two Log DROP_HOSTILE options, one for incoming and one for outgoing traffic so that it is not a all or nothing situation.
I will have a look at doing the changes and submit a v3 version of my patch.
After a month of checking the logs, I can confirm that the “Low” Detail level doesn’t lower the noise in the Firewall logs, maybe it works for the Log Summary only.
@bonnietwin Is there a way to create custom “Locations” or “Countries”. Just like there is an “XD” location in the Location block , based on the Spamhaus DROP IP
Blocklist.
If I could create a locaton based on a blocklist , I could just create a firewall rule. that would block outgoing packets going to this “location” and on the bottom of the rule there is an option to Log the rule or not to Log Rule.
For example BOGON is an important list to block but the log gets too crowded with all the BOGON entries.
Firstly in the firewall rulesets where to stop the logging you have to turn of the Logging in Firewall Options as you showed.
Secondly in the IP Block List where to stop the logging you have to disable the checkbox named “Log dropped packets” at the top of the IP Block Lists WUI page.
As the IP Blocklist is dealt with early in the sequence before the firewall iptables rules then you will still see the logs even if the firewall options logging is turned off, if the IP Block List logging is still enabled.
It looks like I missed something. @casabenedetti has flagged up in a post today that the DROP_HOSTILE was not showing up in the logs, although they were set as enabled.
If you just press the Save button on the Firewall Options page and then reboot, it will then work correctly.
I obviously missed some command in the update.sh script to include the modified logging options.
I will look to get that corrected as quickly as possible so future upgraders to 184 don’t have the problem.
I presume because some of them need to have the iptables completely re-constructed not just some rules appended and that is done as part of a reboot and better not done on a connected firewall.
Above is just my belief. I have not checked through the code to confirm or not.
