Re: GeoIP Blocked IPs not being logged

[Rob Brewer <ipfire-devel@grantura.co.uk>]

[-- Attachment #1: Type: text/plain, Size: 1428 bytes --]

Hi Michael

Michael Tremer wrote:

> Hello Rob,
> 
> Thank you for submitting this patch.
> 
> There are several issues with this patch:
> 
> * It has been line-wrapped and therefore does not apply
> 
Apologies I'll try again without wrapping:

--- build/usr/lib/firewall/rules.pl.orig        2019-02-04 20:59:34.677143496 +0000
+++ build/usr/lib/firewall/rules.pl     2019-02-04 21:01:59.445137411 +0000
@@ -609,6 +609,8 @@
        # is enabled.
        foreach my $location (@locations) {
                if(exists $geoipsettings{$location} && $geoipsettings{$location} eq "on") {
+      # add logging for geoip rwb 4/2/19
+                        run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc $location -j LOG --log-prefix 'GEOIPBLOCK-$location '");
                        run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc $location -j DROP");
                }
        }


> * It is actually intended behaviour of the GeoIP filter to not log those.
> Many systems are flooded with log messages and this filter is supposed to
> skim some things out entirely.
> 
I understand your thinking but it does mess up reporting the logs as I do to Dshield.


> However, I do not think that this is a bad idea, but it should be
> configurable on the firewall options page.
> 
Yes I was thinking that this could be easily select-able with an if statement around the LOG line if required.


Rob