Home / ubuntu / Questions / 1317682
In Process
Gqqnbig
Asked: 2021-02-20 05:04:51 +0800 CST

ufw differentiates block-and-log from unmatched log

  • 772

I insert block rules using this kind of statements

sudo ufw insert 1 deny log from 45.136.228.230/24

I have a few hundreds of such deny-log rules.

ufw will block the IP and log the event. However, another feature that comes with ufw logging low is that ufw will also log packets not matching the defined policy.

I want to separate or differentiate the ones I explicitly set as deny log from the ones because of unmatching.

--log-prefix in /etc/ufw/user.rules looks promising, but once I add new rules to ufw through the ufw interface, my modifications on user.rules are lost.

How do I set up so that for each entry in ufw.log, I can quickly tell if it's blocked by my deny-log rules or because of not matching the defined policy?

18.04

0 Answers