Re: pgsql-ulogd2

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Jul 16, 2012 at 03:27:59PM +0200, Florian Westphal wrote:
> Mr Dash Four <mr.dash.four@googlemail.com> wrote:
> > 
> > >>The specific reason I raised this issue is because on the main
> > >>firewall we have here, if I deploy ulogd2 and use NFCT at its
> > >>present form, I will get the logs from all 7 interfaces, and it
> > >>would make it an absolutely huge task to sift through all these logs
> > >>and "match" the various entries (OK, doing it through the database
> > >>will help up a bit, but not a lot).
> > >
> > >Try something like
> > >iptables -t raw -A PREROUTING (thingsyoudontwant) -j CT --ctevents related
> > What do you mean by "(thingsyoudontwant)"? How would that affect
> > tracking (sorry, I probably need to brush-up on the CT a bit)?
> 
> It specifies what events to generate; Events that aren't generated can't be
> seen by NFCT.  Tracking itself is not influenced.
> 
> As Pablo pointed out, you could also try disabling event reporting
> completely via sysctl and only enable events for those networks/services
> you're interested in.
> 
> So e.g. if you are only interested in logging the start and end
> of connections coming from 192.168.1/24 on eth0 and going out
> via eth7 you could try
> 
> echo 0 > /proc/sys/net/netfilter/nf_conntrack_events

oops, sorry, this is not what I meant to say. This line above
*completely* disables events. Thus, the line below does not have effect
anymore.

> iptables -t raw -A PREROUTING -i eth0 -o eth7 \
> 	 -s 192.168.1.0/24 -j CT --ctevents new,related,destroy

It should be hard to add some "none" for --ctevents so you can add to
the following rules below:

iptables -t raw -A PREROUTING -i eth0 -o eth7 \
	 -s 192.168.1.0/24 -j CT --ctevents new,related,destroy
iptables -t raw -A PREROUTING -i eth0 -o eth7 \
	 ! -s 192.168.1.0/24 -j CT --ctevents none

Not to report events for others. Note that the "none" is missing now
in iptables.

Thus, we will only get events coming from 192.168.1.0/24.

Still, for better per-process (not global) filtering some ulogd2
filter that uses the libnetfilter_conntrack filtering based on
Berkeley Socket Filters can help.

I remember that I posted some patches long time ago to add
unicast-based ctevent. These days that could be easier by reusing the
user-space cthelper infrastructure that went into the kernel for
3.7.