ipfw and log server
Paul Chvostek
paul+fbsd at it.ca
Wed Jul 14 05:40:40 PDT 2004
On Wed, Jul 14, 2004 at 11:38:52AM +0700, Mohammad Reza wrote:
>
> I have trouble with my ipfw rules. My firewall server is logging server
> form my several mail gateway (syslogd)
> I want my ipfw rules to be default to deny,
> I add this rules before deny everything else
> ${fwcmd} add pass udp from {mail_gateway} to me 514 in via ${iif}
> keep-state
> but I cant no longer see my logging to firewall.
I'll assume the missing '$' before '{mail_gateway}', is just a
cut-and-paste error. ;)
Try adding a "log" directive to the deny rules that follow this allow
rule.
Alternately, add an explicit set of logging rules to identify the
traffic that's being missed by your allow rule. For example:
${fwcmd} add pass udp from ${mail_gateway} to me 514 in via ${iif}
${fwcmd} add count log udp from ${mail_gateway} to any 514
Then check your /var/log/security.
--
Paul Chvostek <paul at it.ca>
Operations / Abuse / Whatever
it.canada, hosting and development http://www.it.ca/
More information about the freebsd-net
mailing list