ipfw and log server

[Paul Chvostek]

On Wed, Jul 14, 2004 at 11:38:52AM +0700, Mohammad Reza wrote:
>  
> I have trouble with my ipfw rules. My firewall server is logging server
> form my several mail gateway (syslogd)
> I want my ipfw rules to be default to deny,
> I add this rules before deny everything else 
> ${fwcmd} add pass udp from {mail_gateway}  to me 514 in via ${iif}
> keep-state
> but I cant no longer see my logging to firewall.

I'll assume the missing '$' before '{mail_gateway}', is just a
cut-and-paste error.  ;)

Try adding a "log" directive to the deny rules that follow this allow
rule.

Alternately, add an explicit set of logging rules to identify the
traffic that's being missed by your allow rule.  For example:

  ${fwcmd} add pass udp from ${mail_gateway} to me 514 in via ${iif}
  ${fwcmd} add count log udp from ${mail_gateway} to any 514

Then check your /var/log/security.

-- 
  Paul Chvostek                                             <paul at it.ca>
  Operations / Abuse / Whatever
  it.canada, hosting and development                   http://www.it.ca/