fix: #2123 Logging of user defined firewall rules

[pve-docs.git] / pve-firewall.adoc

diff --git a/pve-firewall.adoc b/pve-firewall.adoc
index 11fe9166323500c0c456f0e83d73518be77691d6..555e90ee6789b38f6c41bf7efe0254a2ce42edac 100644 (file)
--- a/pve-firewall.adoc
+++ b/pve-firewall.adoc
@@ -1,7 +1,7 @@
+[[chapter_pve_firewall]]
 ifdef::manvolnum[]
 pve-firewall(8)
 ===============
-include::attributes.txt[]
 :pve-toplevel:
 
 NAME
@@ -19,14 +19,12 @@ include::pve-firewall.8-synopsis.adoc[]
 DESCRIPTION
 -----------
 endif::manvolnum[]
-
 ifndef::manvolnum[]
 {pve} Firewall
 ==============
-include::attributes.txt[]
+:pve-toplevel:
 endif::manvolnum[]
 ifdef::wiki[]
-:pve-toplevel:
 :title: Firewall
 endif::wiki[]
 
@@ -82,6 +80,7 @@ comments. Sections starts with a header line containing the section
 name enclosed in `[` and `]`.
 
 
+[[pve_firewall_cluster_wide_setup]]
 Cluster Wide Setup
 ~~~~~~~~~~~~~~~~~~
 
@@ -144,6 +143,7 @@ To simplify that task, you can instead create an IPSet called
 firewall rules to access the GUI from remote.
 
 
+[[pve_firewall_host_specific_configuration]]
 Host Specific Configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -165,7 +165,7 @@ include::pve-firewall-host-opts.adoc[]
 
 This sections contains host specific firewall rules.
 
-
+[[pve_firewall_vm_container_configuration]]
 VM/Container Configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -201,10 +201,6 @@ Each virtual network device has its own firewall enable flag. So you
 can selectively enable the firewall for each interface. This is
 required in addition to the general firewall `enable` option.
 
-The firewall requires a special network device setup, so you need to
-restart the VM/container after enabling the firewall on a network
-interface.
-
 
 Firewall Rules
 --------------
@@ -235,8 +231,8 @@ Here are some examples:
 IN SSH(ACCEPT) -i net0
 IN SSH(ACCEPT) -i net0 # a comment
 IN SSH(ACCEPT) -i net0 -source 192.168.2.192 # only allow SSH from 192.168.2.192
-IN SSH(ACCEPT) -i net0 -source 10.0.0.1-10.0.0.10 # accept SSH for ip range
-IN SSH(ACCEPT) -i net0 -source 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for ip list
+IN SSH(ACCEPT) -i net0 -source 10.0.0.1-10.0.0.10 # accept SSH for IP range
+IN SSH(ACCEPT) -i net0 -source 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for IP list
 IN SSH(ACCEPT) -i net0 -source +mynetgroup # accept ssh for ipset mynetgroup
 IN SSH(ACCEPT) -i net0 -source myserveralias #accept ssh for alias myserveralias
 
@@ -247,6 +243,7 @@ OUT ACCEPT # accept all outgoing packages
 ----
 
 
+[[pve_firewall_security_groups]]
 Security Groups
 ---------------
 
@@ -271,7 +268,7 @@ Then, you can add this group to a VM's firewall
 GROUP webserver
 ----
 
-
+[[pve_firewall_ip_aliases]]
 IP Aliases
 ----------
 
@@ -306,10 +303,10 @@ explicitly assign the local IP address
 ----
 #  /etc/pve/firewall/cluster.fw
 [ALIASES]
-local_network 1.2.3.4 # use the single ip address
+local_network 1.2.3.4 # use the single IP address
 ----
 
-
+[[pve_firewall_ip_sets]]
 IP Sets
 -------
 
@@ -357,7 +354,7 @@ Traffic from these IPs is dropped by every host's and VM's firewall.
 ----
 
 
-[[ipfilter-section]]
+[[pve_firewall_ipfilter_section]]
 Standard IP set `ipfilter-net*`
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -407,6 +404,49 @@ If you want to see the generated iptables rules you can use:
 
  # iptables-save
 
+Logging of firewall rules
+-------------------------
+
+By default, logging of traffic filtered by the firewall rules is disabled. To
+enable logging for the default firewall rules, the log-level for incommig and
+outgoing traffic has to be set in the firewall `Options` tab for the host and/or
+the VM/CT firewall.
+Logging of dropped packets is rate limited to 1 packet per second in order to
+reduce output to the log file.
+Further, only some dropped or rejected packets are logged for the standard rules.
+
+In order to log packets filtered by user-defined firewall rules, it is possible
+to set a log-level parameter for each rule individually.
+This allows to log in a fine grained manner and independent of the log-level
+defined for the standard rules.
+In particular, each rule is logged independently from the log-level set for the
+standard rules in the firewall `Options`.
+
+The log level for the rule can also be set via the firewall configuration file by
+appending a `-log <loglevel>` to the selected rule.
+Here, `<loglevel>` is one of the following flags, attached to the log output:
+`nolog, emerg, alert, crit, err, warning, notice, info, debug`
+
+For example:
+
+----
+IN REJECT -p icmp -log nolog
+----
+
+is the same as
+
+----
+IN REJECT -p icmp
+----
+
+whereas
+
+----
+IN REJECT -p icmp -log debug
+----
+
+produces a log output flagged with the `debug` level.
+
 
 Tips and Tricks
 ---------------
@@ -474,7 +514,7 @@ address are used. By default the `NDP` option is enabled on both host and VM
 level to allow neighbor discovery (NDP) packets to be sent and received.
 
 Beside neighbor discovery NDP is also used for a couple of other things, like
-autoconfiguration and advertising routers.
+auto-configuration and advertising routers.
 
 By default VMs are allowed to send out router solicitation messages (to query
 for a router), and to receive router advertisement packets. This allows them to
@@ -486,7 +526,7 @@ As for the link local addresses required for NDP, there's also an ``IP Filter''
 (`ipfilter: 1`) option which can be enabled which has the same effect as adding
 an `ipfilter-net*` ipset for each of the VM's network interfaces containing the
 corresponding link local addresses.  (See the
-<<ipfilter-section,Standard IP set `ipfilter-net*`>> section for details.)
+<<pve_firewall_ipfilter_section,Standard IP set `ipfilter-net*`>> section for details.)
 
 
 Ports used by {pve}