How can I tell susefirewall not to log about a certain port?

Sunday 15 July 2007 15:13:12 Carlos E. R. wrote:
Hi,
>
In the /etc/sysconfig/SuSEfirewall2 file I have:
>
>
FW_SERVICES_EXT_TCP="4662"
>
But entries to that port are logged:
>
Jul 15 14:07:25 nimrodel kernel: SFW2-INext-ACC-TCP IN=eth0 UT=
SRC=189
DST=192.168.1 LEN=48 TS=0x00 PREC=0x00 TTL=112 ID=6454 DF PRT=TCP
SPT=50867 DPT=4662 WINDW=64240 RES=0x00 SYN URGP=0 PT (0204058401010402)
>
As it is a port I opened, I understand it should not be logged, it is not
a "critical" port. I have:
>
FW_LG_DRP_CRIT="yes"
FW_LG_DRP_ALL="yes"
FW_LG_ACCEPT_CRIT="yes"
FW_LG_ACCEPT_ALL="no"
>
>
What could I do so that they are not logged? I want other port logged, but
not those I explicitly opened myself.

Hi,

Since SuSEfirewall is merely a front-end for iptables, you can accomplish what
you need by taking advantage of the following fact:

iptables rules that have a target ACCEPT, DRP or REJECT cause the processing
of subsequent rules to be terminated. To do logging, SuSE firewall sets two
rules for the specific match: forst a LG rule and then a ACCEPT/DRP rule to
specify the packet's fate.

This allows you to do the following:
Editing the / file and find the
fw_custom_before_port_handling() function definition. Inside the function
(that is - before the 'true' command) add a rule that would accept all
traffic to the port in question. That should be something like this:

iptables -t filter -I input_ext -p tcp 4662 -j ACCEPT

You should no longer see any logging output for that port.

A drawback is that you should add a rule for each port you have opened. You
can overcome this by creating a script that would check the firewall's
configuration file in /etc/sysconfig and add ACCEPT rules for each port
opened (mind that services might be specified by both port number and service
name for well-known services, as found in /etc/services file). If you have
trouble writing such a script, please don't hesitate to contact me again.

Best regards.

--
Blade hails you

The music is dead, the amen is said
The kiss of faith is what I beg


PGP SIGNATURE
Version: GnuPG v1.4.2 (GNU/Linux)


fruFsLpPaEFiluGIpT7IBZg=
=h1D1
PGP SIGNATURE