Hi Forum,
I'm trying actually to harden my firewall - and turned on the logging option to see what's going on. Now the firewall floods the logs with messages of dropping packets that are outside of my box's interest. So is there a possibility eg. to hook a script between logd and it's ring buffer or between the buffer and the output eg. to a file? Is it doable eg. with syslog? To put a big sed in between?
The messages I want to eleminate are like
Sun Jun 14 19:18:22 2020 kern.warn kernel: [13638.346089] DROP wan in: IN=pppoe-wan OUT= MAC= SRC=185.39.11.38 DST=77.8.2.140 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=35137 PROTO=TCP SPT=54982 DPT=25223 WINDOW=1024 RES=0x00 SYN URGP=0
Sun Jun 14 19:18:47 2020 kern.warn kernel: [13663.499825] DROP wan in: IN=pppoe-wan OUT= MAC= SRC=194.26.29.52 DST=77.8.2.140 LEN=40 TOS=0x00 PREC=0x20 TTL=243 ID=46889 PROTO=TCP SPT=47069 DPT=2121 WINDOW=1024 RES=0x00 SYN URGP=0
... and so on
DST points to x4d08028c.dyn.telefonica.de, the only constant thing here is the domainname, so filtering is a little task anyway... None of the source IPs are belonging to anything known and are not resolveable (with exceptions). But those lines are so many that the interesting messages aren't visible... Or do I have to save 'em into a file which I can push through a sed afterwards?
it's a Fritzbox 7412 running 19.07.3 which acts as my main internet router, wan is actually the PPPoE-connection to my ISP - guess why I want to harden the firewall...
Best regards
Peter