From c22369a916896366717519289112db43e54ca5eb Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Tue, 28 Apr 2020 12:10:15 +0100 Subject: [PATCH] firewall: Log accepted connections even when NAT is active Signed-off-by: Michael Tremer Signed-off-by: Arne Fitzenreiter --- config/firewall/rules.pl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl index 6129af8610..387a8f92ba 100644 --- a/config/firewall/rules.pl +++ b/config/firewall/rules.pl @@ -511,7 +511,7 @@ sub buildrules { push(@options, @destination_options); # Insert firewall rule. - if ($LOG && !$NAT) { + if ($LOG) { run("$IPTABLES -A $chain @options @source_intf_options @destination_intf_options @log_limit_options -j LOG --log-prefix '$chain '"); } run("$IPTABLES -A $chain @options @source_intf_options @destination_intf_options -j $target"); @@ -522,7 +522,7 @@ sub buildrules { # is granted/forbidden for any network that the firewall itself is part of, we grant/forbid access # for the firewall, too. if ($firewall_is_in_destination_subnet && ($target ~~ @special_input_targets)) { - if ($LOG && !$NAT) { + if ($LOG) { run("$IPTABLES -A $CHAIN_INPUT @options @source_intf_options @log_limit_options -j LOG --log-prefix '$CHAIN_INPUT '"); } run("$IPTABLES -A $CHAIN_INPUT @options @source_intf_options -j $target"); @@ -530,7 +530,7 @@ sub buildrules { # Likewise. if ($firewall_is_in_source_subnet && ($target ~~ @special_output_targets)) { - if ($LOG && !$NAT) { + if ($LOG) { run("$IPTABLES -A $CHAIN_OUTPUT @options @destination_intf_options @log_limit_options -j LOG --log-prefix '$CHAIN_OUTPUT '"); } run("$IPTABLES -A $CHAIN_OUTPUT @options @destination_intf_options -j $target"); -- 2.39.5