Re: GeoIP Blocked IPs not being logged

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 1737 bytes --]

Hello Rob,

Thank you for submitting this patch.

There are several issues with this patch:

* It has been line-wrapped and therefore does not apply

* It is actually intended behaviour of the GeoIP filter to not log those. Many systems are flooded with log messages and this filter is supposed to skim some things out entirely.

However, I do not think that this is a bad idea, but it should be configurable on the firewall options page.

-Michael

> On 4 Feb 2019, at 21:08, Rob Brewer <ipfire-devel(a)grantura.co.uk> wrote:
> 
> Hi
> 
> After adding a few country codes with the GeoIP Configuration page, Geo 
> blocked IPs no longer appear in the Firewall Logs.
> 
> This might be the intended operation but for me I would like to log these 
> blocked IPs and have added a logging rule to /usr/lib/firewall/rules.pl
> 
> This is my patch for rules.pl which I have tested on my live IPFire and is 
> working OK.
> 
> diff -u build/usr/lib/firewall/rules.pl.orig build/usr/lib/firewall/rules.pl
> --- build/usr/lib/firewall/rules.pl.orig        2019-02-04 
> 20:59:34.677143496 +0000
> +++ build/usr/lib/firewall/rules.pl     2019-02-04 21:01:59.445137411 +0000
> @@ -609,6 +609,8 @@
>        # is enabled.
>        foreach my $location (@locations) {
>                if(exists $geoipsettings{$location} && 
> $geoipsettings{$location} eq "on") {
> +      # add logging for geoip rwb 4/2/19
> +                        run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc 
> $location -j LOG --log-prefix 'GEOIPBLOCK-$location '");
>                        run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc 
> $location -j DROP");
>                }
>        }
> 
> 
> Regards
> 
> Rob
> 
>