Hello Rob,
Thank you for submitting this patch.
There are several issues with this patch:
* It has been line-wrapped and therefore does not apply
* It is actually intended behaviour of the GeoIP filter to not log those. Many systems are flooded with log messages and this filter is supposed to skim some things out entirely.
However, I do not think that this is a bad idea, but it should be configurable on the firewall options page.
-Michael
On 4 Feb 2019, at 21:08, Rob Brewer ipfire-devel@grantura.co.uk wrote:
Hi
After adding a few country codes with the GeoIP Configuration page, Geo blocked IPs no longer appear in the Firewall Logs.
This might be the intended operation but for me I would like to log these blocked IPs and have added a logging rule to /usr/lib/firewall/rules.pl
This is my patch for rules.pl which I have tested on my live IPFire and is working OK.
diff -u build/usr/lib/firewall/rules.pl.orig build/usr/lib/firewall/rules.pl --- build/usr/lib/firewall/rules.pl.orig 2019-02-04 20:59:34.677143496 +0000 +++ build/usr/lib/firewall/rules.pl 2019-02-04 21:01:59.445137411 +0000 @@ -609,6 +609,8 @@ # is enabled. foreach my $location (@locations) { if(exists $geoipsettings{$location} && $geoipsettings{$location} eq "on") {
# add logging for geoip rwb 4/2/19run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc$location -j LOG --log-prefix 'GEOIPBLOCK-$location '"); run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc $location -j DROP"); } }
Regards
Rob