Yrurtj

I'm running Fedora 20 and would like to see what my firewall is doing in the background. Is it possible to view a log of the traffic blocked by FirewallD?

According to this page, the FirewallD logs are at /var/log/firewalld. To get debug messages, you need to run it with --debug or --debug=2.

I know this is a dated post, but I've been searching for this today, and have found tons of old blogs that attempt to address this issue. For the public, this update from Red Hat should be more available than only to subscribers:

Upgrade to firewalld-0.4.3.2-8.el7 from Errata RHSA-2016:2597

Specify which packets should be logged

firewall-cmd --set-log-denied=<value>

value may be one of: all, unicast, broadcast, multicast, or off

Source: https://access.redhat.com/solutions/1191593

You need append the line in /etc/sysconfig/firewalld

for maximum details:

FIREWALLD_ARGS=--debug=10

Then restart firewalld service

sudo systemctl restart firewalld

It's better, than edit /usr/lib/systemd/system/firewalld.service.

For logging the traffic blocked by firewalld, the following approach with rsyslogd worked for me:

Edit /etc/sysconfig/firewalld and update the value for LogDenied to all (or as required)

LogDenied=all

restart firewalld

sudo systemctl restart firewalld

This typically adds logging rules just before reject/drop rules in the firewall, something like:

LOG  all  --  anywhere   anywhere  LOG level warning prefix "IN_drop_DROP: "

LOG  all  --  anywhere   anywhere  LOG level warning prefix "FINAL_REJECT: "

Create a file named /etc/rsyslog.d/custom_iptables.log and add the following statements to it:

:msg,contains,"_DROP" /var/log/iptables.log

:msg,contains,"_REJECT" /var/log/iptables.log

& stop

restart rsyslog

sudo systemctl restart rsyslog   

Now the dropped and rejected packets will be logged to /var/log/iptables.log

you can see the logging information by using iptables:

first open the command line and run iptables service:

service iptables start

second write this command:

iptables -A INPUT -j LOG --log-level info --log-prefix "iptables INPUT:"

then you can write this command:

tail -f /var/log/messages

it will give you the logging information you are looking for

the code above let you see what your firewall do with the packets which enter to your network, you can also see the packets which get out of your network by replacing INPUT by OUTPUT in the second command above