Hello,
I am aware that the default firewall design means that when you enable logging in a zone, it logs REJECTed packets only.
Is there a way of logging ACCEPTed packets, specifically ICMP ping from a local network device?
I know that you could build e.g. a tcpdump script that logs them but that involves additional libraries, etc.
I don't understand why you want something like this but it works (192.168.x.y a host in lan and 192.168.a.b a host after the wan of this router):
config rule
option src '*'
option dest '*'
option name 'test'
list proto 'icmp'
list src_ip '192.168.x.y'
list dest_ip '192.168.a.b'
option target 'ACCEPT'
option log '1'
option enabled '1'
logread
Wed Sep 2 21:35:24 2026 kern.warn kernel: [1069069.475000] test: IN=br-lanOUT=wan MAC=xxxxxxx SRC=192.168.x.y DST=192.168.a.b LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=52795 DF PROTO=ICMP TYPE=8 CODE=0 ID=43117 SEQ=1
Note: if you meant ping between two devices on the same LAN, this rule won't help — that traffic never passes through the firewall (unless there's L2 isolation between bridges/VLANs).
For L2 connections you will need to use (but it's not the same as openwrt's fw4 firewall, sorry but I can't find any recent documentation about this on openwrt) :
To simplify the ask, I was interested in "tracking who is pinging the router".
This would mean ICMP Ping to the router's interface, so (hopefully) filtering a bridge shouldn't be necessary.
One more thing: once you can see the pings in logread, if you want to be notified rather than checking logs manually, you could hook something up to watch for that log pattern and alert you — e.g. a small script triggered by logread -f | grep ... piped to a notification tool, or on more capable hardware a proper log-monitoring daemon (rsyslog/syslog-ng with an action rule, or something like swatch/logcheck) that can send an email, a Telegram/ntfy push, etc. Depends a lot on what you're already running on the router and how you want to be notified.
Yes, I think I underestimated how a few pings could affect the log buffer, which isn't that large by default.
I'm investigating using a netfilter hook (compiled kernel module) to break the info out another way.
For combining netfilter with potentially large volumes of logged information, ulogd is the only sensible choice I am aware of. Not sure how well that stuff is integrated with fw4, if at all, but ulogd packages do exist.
If you need to log high volumes then use a remote syslog server.
So, I managed to rustle something up:-
Amongst other things, I downloaded and used the SDK for my router for the first time, started off with some hook code that allegedly worked against kernel < 4.17 and fixed it, being fairly suboptimal in my approach because I've never written a kernel module before and it's hard to get concrete answers about things like the kernel mode sockets API. 
My design is basically to hook on NF_INET_LOCAL_IN (which is the second hook), identify the correct type of packet, then send some info to a UNIX domain socket so that a userspace daemon (I wrote a test one in Python) can collect it.
It was really shocking that it actually worked (no I didn't use AI), but the packet doesn't seem to have an arrival timestamp like I expected (the daemon receives all zeroes for that field).
I need a lie down...
