Re: Logging Locationblock packets [PATCH]

[Rob Brewer <ipfire-devel@grantura.co.uk>]

[-- Attachment #1: Type: text/plain, Size: 2096 bytes --]

On Wed, 20 Nov 2024 23:08:39 -0000 (UTC), Rob Brewer wrote:

I've tested these patches on Core-Update 189 and can enable and disable 
locationblock logging.
I can provide the patches in a different format if preferred.

Rob

> OK - I have modified location-block.cgi to add an additional checkbox at
> the top of the page titled "Log dropped packets", very similar to
> ipblocklist.cgi. This adds a entry to the /var/ipfire/firewall/
> locationblock settings file ON or OFF.
> 

/srv/web/ipfire/cgi-bin/location-block.cgi
=================================================================
62a63,69
>         # Check if we want to disable logging.
>         if (exists $cgiparams{'LOGGING_ENABLED'}) {
>                 $settings{'LOGGING_ENABLED'} = "on";
>         } else {
>                 $settings{'LOGGING_ENABLED'} = "off";
>       }
> 
93a101
> my $logging;
97a106,111
> if ($settings{'LOGGING_ENABLED'} eq "on") {
>         $logging = "checked='checked'";
> }
> 
> 
> 
108a123,125
>                         <td width='50%' 
class='base'>$Lang::tr{'ipblocklist log'}
>                         <td><input type='checkbox' 
name='LOGGING_ENABLED' $logging></td>
>               </tr>

==========================================================================


> In /usr/lib/firewall/rules.pl I add an additional Iptables LOCATIONBLOCK
> log rule with the prefix 'LOCBLOCK-$location '. This is selectable from
> the Log dropped packets entry in the locationblock settings file.


/usr/lib/firewall/rules.pl
=====================================================================
76c76,77
<       "LOCATIONBLOCK_ENABLED" => "off"
---
>       "LOCATIONBLOCK_ENABLED" => "off",
>       "LOGGING_ENABLED" => "off",
719a721,725
> 
>       # add loggging if enabled from location-block.cgi
>               if ($locationsettings{'LOGGING_ENABLED'} eq "on") {     
>                       run("$IPTABLES -A LOCATIONBLOCK -m set --match-set 
$location src -j LOG --log-prefix 'LOCBLOCK-$location '");
>                       }

=========================================================================