[SOLVED] iptables logging inside LXC containers

[Michael B]

Hi everyone,

First of all, after many years of use, I wanted to thanks the whole team behind Proxmox VE for the amazing work!

I'm now since a few months a happy user of Proxmox VE 4 and it's LXC containers.

However, I've lately been facing issues with firewall logging: I am using custom iptables configuration scripts, and it took me some time and online research to find out I should use NFLOG target (not LOG), to get logs in /var/log/pve-firewall.log.

What now works great on the host side doesn't give any result inside LXC containers. For instance, the following rule wont log anything, either on guest or host side:

iptables -A INPUT -p tcp -j NFLOG --nflog-prefix "iptables from lxc "

Is there some specific configuration I should do to get this working?

Thanks in advance for your help!

 

[Michael B]

Okay, after more hours of searching, I found out that ulogd2 (which does the same job as pvefw-logger) has to be installed (and running) in each LXC container where you'd like to log iptables packets ...

Resulting logs will be available in /var/log/ulog/syslogemu.log

 

[tinolin]

Thank you very much for your contribution. It was very useful! Thank you.

 

[Corwin]

Old thread but still useful, thank you !

 

[externalenderman]

Thank you for this !