firewall: Log accepted connections even when NAT is active

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 6129af86103505c557e2649cb63f54a238a92a28..387a8f92ba232dccf6308ae56badc5717a086ff5 100644 (file)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -511,7 +511,7 @@ sub buildrules {
                                        push(@options, @destination_options);
 
                                        # Insert firewall rule.
-                                       if ($LOG && !$NAT) {
+                                       if ($LOG) {
                                                run("$IPTABLES -A $chain @options @source_intf_options @destination_intf_options @log_limit_options -j LOG --log-prefix '$chain '");
                                        }
                                        run("$IPTABLES -A $chain @options @source_intf_options @destination_intf_options -j $target");
@@ -522,7 +522,7 @@ sub buildrules {
                                                # is granted/forbidden for any network that the firewall itself is part of, we grant/forbid access
                                                # for the firewall, too.
                                                if ($firewall_is_in_destination_subnet && ($target ~~ @special_input_targets)) {
-                                                       if ($LOG && !$NAT) {
+                                                       if ($LOG) {
                                                                run("$IPTABLES -A $CHAIN_INPUT @options @source_intf_options @log_limit_options -j LOG --log-prefix '$CHAIN_INPUT '");
                                                        }
                                                        run("$IPTABLES -A $CHAIN_INPUT @options @source_intf_options -j $target");
@@ -530,7 +530,7 @@ sub buildrules {
 
                                                # Likewise.
                                                if ($firewall_is_in_source_subnet && ($target ~~ @special_output_targets)) {
-                                                       if ($LOG && !$NAT) {
+                                                       if ($LOG) {
                                                                run("$IPTABLES -A $CHAIN_OUTPUT @options @destination_intf_options @log_limit_options -j LOG --log-prefix '$CHAIN_OUTPUT '");
                                                        }
                                                        run("$IPTABLES -A $CHAIN_OUTPUT @options @destination_intf_options -j $target");