Logging outbound denied packets does not work anymore since upgrading LEDE to OpenWrt

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi all. I use OpenWRT since about 2013 with a TP-Link WDR4300 back then, and now an Archer C2600. With LEDE, I started using more advanced firewall rules. My basic Idea is to REJECT everything which is not explicitly allowed and log the denied connections.

I achieved this with the following config in /etc/config/firewall:

config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option log '1'

However, since upgrading to OpenWRT 18.06 (tried with 18.06.1 and 18.06.4), logging stopped working. (I just copied the /etc/config/firewall file from the LEDE installation)

Before, I could see Denied Outbound Connections with logread, this is not possible anymore. If I enable logging for e.g. the WAN connection, I see log entries.

iptables -L indicates that the necessary firewall rules seem to be present:

Chain zone_lan_dest_REJECT (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 10/sec burst 5 /* !fw3 */ LOG level warning prefix "REJECT lan out: "
reject all -- anywhere anywhere /* !fw3 */

Still, nothing in the log.

Was there any Change from LEDE 17 to OpenWrt 18 of which I am not aware of?

Thanks, and kind regards

2

From a lan client device are you still seeing rejections when you try to connect to something not allowed through?

(I just copied the /etc/config/firewall file from the LEDE installation)

This could be the problem , recommendation when upgrading major releases (eg. 17.x to 18.x) is to export all your configs, upgrade with default settings, then manually apply your settings again adjusting when things are different in the new version.

3

Hi Sparks, thank you for your response.

Firewall rules all seem to work as intended. For example, if I disable the "Allow Ping from LAN to WAN rule", a ping to the Internet would result in "Destination Port unreachable" - which means packets get denied instead of dropped (or even allowed).

Howeber, nothing in the log.

4

I think the problem could be that the rulesets ( i never used 17 ) fork into specific chains for "zone/interface/direction" very early on in the chainsets.

So the way your used to doing it ... would need to be applied per zone / direction in order to be picked up. manually dumping the rulesets with "iptables-save" is the clearest way to get a handle on where your rule is sitting.... ( pay attention to the custom "lan_zone_xyz" fragmentations )

Perhaps the gui would work too... don't use it myself... ( for the firewall anyway )... I do know that something just does not look right in the syntax you've posted in your original post.

This is a the general raw format for intercepting prior to the directional/zone rules.... it's not the most efficient way to do things... but it highlights why and where rules further down don't catch things...

#### NEW LOG CHAIN

iptables -N mylog

#### RULE/RULES TO CATCH AND LOG

iptables -A mylog MATCHONLYTHESETHINGS -j LOG --log-prefix "thesethingsmatchedXYZ " --log-level $myloglevel
( you may want a matching DROP rule here )

#### GO BACK TO THE OTHER RULES

iptables -A mylog -j RETURN

#### EARLY IN THESE CHAINS JUMP TO mylog for checking ( try putting them at different places in each zone/chain probably lan_forward with source ip... once your confident you can have mylog drop everything )

iptables -I input_rule 1 -j mylog
iptables -I forwarding_rule 1 -j mylog
iptables -I output_rule 1 -j mylog
5

Same behavior when using the stock firewall config shipped with 18.06:

Default:

config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT

# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

Changed to...

config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT
        option log              1

(forwarding line removed)

Nothing in the Log though packets get rejected as they should

6

I now tried it with a fresh Install (18.06.5) in an x86 VM and see the same behavior.

Stock Firewall Rules. Enable Logging on LAN zone. Disable Forwarding to the WAN Zone.

Packets get rejected but nothing appears in the Log.