pfSense

When I add this change, I am then unable to then redirect the logs to a remote host from the GUI as normal, the same setup works fine without the localhost binding.

Should we do this conditionally, perhaps only bind to localhost if there are no remote syslog servers defined?

I thought there was a catch along those lines here. Though it's interesting that Paul can log to syslog-ng running locally by IP, maybe because it's logging from 127.0.0.1 to another local IP in that case. Implementing it to only do that when not logging to a remote host would defeat the purpose that Paul is looking for, but it may not be possible to accommodate that scenario.

Jim P wrote:

When I add this change, I am then unable to then redirect the logs to a remote host from the GUI as normal, the same setup works fine without the localhost binding.

Should we do this conditionally, perhaps only bind to localhost if there are no remote syslog servers defined?

this is really odd. i don't understand why the address pfsense syslogd binds to would prevent sending datagrams to a remote syslog host. hmmmm....

Only thing I can think of is that it somehow was invoking syslogd with the '-ss' flag to prevent any network usage. Was that it maybe, Jim?

I was the original proposer..

I have syslogd bound only to localhost and I successfully get it to repeat the syslog message to a different IP (usually the sync IP) on which syslog-ng is listening, so I am not sure why you think this breaks syslog forwarding off host, unless of course (thinking aloud) that binding syslogd to localhost means it can't send UDP off-host?

Paul Mansfield wrote:

I was the original proposer..

I have syslogd bound only to localhost and I successfully get it to repeat the syslog message to a different IP (usually the sync IP) on the same firewall, on which syslog-ng is listening, so I am not sure why you think this breaks syslog forwarding off host, unless of course (thinking aloud) that binding syslogd to localhost means it can't send UDP off-host?

Another issue related to this task is logging to a remote syslog server, where remote I mean to the other side of a Point-To-Point VPN.
If seems like that if syslogd is not binded to a specific interface/IP address (the local side of the VPN), the packets will never arrive to the other side of the VPN.

Or am I wrong?

Thanks,
Michele

It depends on the type of VPN. With OpenVPN it works fine, it just sources the syslog traffic from the tunnel interface IP.

With IPsec it's a bit different, it does require you to add a static route to work around the binding.

Wow, yes. I just created a fake gateway using the local interface IP address (which is a bridge interface), and a static route for my remote syslog server that uses that gateway, and it does work!
It looks like a workaround, but it does the job. Thanks Jim!

That has been documented for quite some time on the doc wiki:
http://doc.pfsense.org/index.php/Why_can%27t_I_query_SNMP,_use_syslog,_NTP,_or_other_services_initiated_by_the_firewall_itself_over_IPsec_VPN%3F

Mh, I was googling for the wrong keywords (focusing on binding syslogd to a specific interface/address)...
Thanks for giving me the hint, but I swear, I didn't read the solution, your hint was sufficient! :P

Applied in changeset 53c5407e646028a003b2765a87dd3316b21a9497.