From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] firewall: Log accepted connections even when NAT is active
Date: Tue, 28 Apr 2020 12:10:15 +0100
Message-ID: <20200428111015.327-1-michael.tremer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8285537278316344507=="
List-Id: <development.lists.ipfire.org>

--===============8285537278316344507==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 config/firewall/rules.pl | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 6129af861..387a8f92b 100644
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -511,7 +511,7 @@ sub buildrules {
 					push(@options, @destination_options);
=20
 					# Insert firewall rule.
-					if ($LOG && !$NAT) {
+					if ($LOG) {
 						run("$IPTABLES -A $chain @options @source_intf_options @destination_in=
tf_options @log_limit_options -j LOG --log-prefix '$chain '");
 					}
 					run("$IPTABLES -A $chain @options @source_intf_options @destination_int=
f_options -j $target");
@@ -522,7 +522,7 @@ sub buildrules {
 						# is granted/forbidden for any network that the firewall itself is par=
t of, we grant/forbid access
 						# for the firewall, too.
 						if ($firewall_is_in_destination_subnet && ($target ~~ @special_input_t=
argets)) {
-							if ($LOG && !$NAT) {
+							if ($LOG) {
 								run("$IPTABLES -A $CHAIN_INPUT @options @source_intf_options @log_li=
mit_options -j LOG --log-prefix '$CHAIN_INPUT '");
 							}
 							run("$IPTABLES -A $CHAIN_INPUT @options @source_intf_options -j $targ=
et");
@@ -530,7 +530,7 @@ sub buildrules {
=20
 						# Likewise.
 						if ($firewall_is_in_source_subnet && ($target ~~ @special_output_targe=
ts)) {
-							if ($LOG && !$NAT) {
+							if ($LOG) {
 								run("$IPTABLES -A $CHAIN_OUTPUT @options @destination_intf_options @=
log_limit_options -j LOG --log-prefix '$CHAIN_OUTPUT '");
 							}
 							run("$IPTABLES -A $CHAIN_OUTPUT @options @destination_intf_options -j=
 $target");
--=20
2.12.2


--===============8285537278316344507==--