Firewall Logging - Unexpected Logs/ Missing Logs

[Gaugamon]

Hello everyone,

I’m having an issue with the Proxmox firewall that I don’t fully understand, and I’m hoping someone can help clarify it for me. I’ve configured firewalls on each of my VMs, and most of the time, everything works as expected. However, occasionally, I notice strange logs, or even a complete lack of logs.

Here are the specific issues I’ve encountered:

1. Unexpected Log Entries: In one of my VMs, I’ve seen logs showing blocked traffic with source and destination IPs that don’t actually correlate with this VM, yet they still appear in the logs. Why would these unrelated IPs show up?
2. Missing Logs: Sometimes, I don’t see any logs on the VM firewall, even when I know traffic is being blocked (I’ve tested it myself). My log_level_in and log_level_out settings are set to info, and I’ve tested this with different rules, setting logging on each rule to info. But still, no logs appear.

I first noticed this when a program on my server wasn’t working. After troubleshooting, I realized it was due to a blocked port required by the program. However, the blocked traffic wasn’t shown in the logs. Once I added a rule for that port, the program started working.

I’m trying to understand why the logs sometimes don’t capture all blocked traffic, and why unrelated IPs occasionally show up. Am I missing something in the configuration?

Thanks in advance for any insights!