5 entries

iptables & UFW

Linux firewall log lines, and how to read the key-value format.

[UFW ALLOW] [UFW ALLOW]: UFW logged a connection it let through Informational UFW recorded a permitted connection. These only appear once you raise the logging level above the default, which is the point most people miss — and at the highest level UFW logs every packet it sees, which will fill a small disk in hours.
IN= OUT= iptables: a packet was logged by a firewall rule Informational The Linux kernel firewall matched a packet against a rule with logging enabled and wrote the packet header to the kernel log. The format is dense and unpunctuated, but every field is a key-value pair and it reads easily once you know the order.
net_ratelimit: callbacks suppressed net_ratelimit: your firewall log is missing lines Worth a look The kernel throttles how fast it will print network messages, and this line is it admitting how many it threw away. Any count you calculate from netfilter LOG output during that window is wrong, usually by a lot — and this is the only warning you get.
nf_conntrack: table full, dropping packet nf_conntrack: table full — the firewall stopped accepting connections Act now The kernel's connection tracking table filled up and it is now dropping new connections. The machine looks fine, the service looks fine, and nothing works — this message in the kernel log is often the only evidence of why.
UFW BLOCK UFW BLOCK: Ubuntu's firewall dropped a packet Informational UFW blocked a connection. It is the same netfilter logging underneath as raw iptables, just with a recognisable prefix — and on any machine reachable from the internet, the volume is normal and expected.