Project

General

Profile

Actions
Copy link

Bug #2249

closed

Outward interface traffic generated by package rules isn't logged when it matches firewall rules that have logging enabled

Added by Stilez y almost 14 years ago. Updated almost 14 years ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Category:
Logging
Target version:
-
Start date:
02/29/2012
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.0.1
Affected Architecture:

Description

Reproducing the issue:

DNS forwarder enabled with no options except these custom rules:

no-hosts
  address=/yahoo.com/127.0.0.1

Set packet capture on the LAN and ping www.yahoo.com from a LAN machine that uses the forwarder, packet capture (correctly) shows an incoming and outgoing packet to/from port 53 on the LAN. Create two firewall rules on the LAN as follows, and enable logging on both:

Pass all traffic from LAN subnet:any port to LAN address:53
  Pass all traffic from LAN address:53 to LAN subnet:any port

Only the incoming query traffic is logged, the outgoing packets aren't. Even if the 2nd rule is widened to pass and log all traffic on the LAN from/to any LAN IP (ie from=network:LAN/nn to=network:LAN/nn), only half the UDP traffic that packet capture sees, is logged.

Actions
Copy link

Also available in: Atom PDF