UFW logging problem

[jokuhn]

Hello,

We are struggling to activate ufw logging within an LXC Container. Ufw
itself seems to work flawlessly but records i.e. corresponding to
packets being dropped do not show up neither in /var/log/syslog nor
anywhere i.e. /var/log/ufw.log as being configured by the Ubuntu packet
installer. The container in question is running current Ubuntu 18.04

I've tried following various hints to no avail. On contrary both on my
local desktop machine and inside a similar KVM virtualized guest ufw
logging works like a charm:

root@mi-ESPRIMO-P958:~# cat /var/log/ufw.log
Apr 20 13:37:30 mi-ESPRIMO-P958 kernel: [22669.631333] [UFW BLOCK]
IN=eno1 OUT= MAC=4c:52:62:3b:12:61:44:4e:6d:b9:8a:99:08:00
SRC=192.168.178.1 DST=192.168.178.51 LEN=60 TOS=0x00 PREC=0x00 TTL=64
ID=39310 DF PROTO=TCP SPT=35071 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0
Apr 20 13:37:31 mi-ESPRIMO-P958 kernel: [22670.633383] [UFW BLOCK]
IN=eno1 OUT= MAC=4c:52:62:3b:12:61:44:4e:6d:b9:8a:99:08:00
SRC=192.168.178.1 DST=192.168.178.51 LEN=60 TOS=0x00 PREC=0x00 TTL=64
ID=39311 DF PROTO=TCP SPT=35071 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0
Apr 20 13:37:33 mi-ESPRIMO-P958 kernel: [22672.649310] [UFW BLOCK]
IN=eno1 OUT= MAC=4c:52:62:3b:12:61:44:4e:6d:b9:8a:99:08:00
SRC=192.168.178.1 DST=192.168.178.51 LEN=60 TOS=0x00 PREC=0x00 TTL=64
ID=39312 DF PROTO=TCP SPT=35071 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0
Apr 20 13:37:37 mi-ESPRIMO-P958 kernel: [22676.841240] [UFW BLOCK]

Any hints greatly appreciated.

 

[oguz]

hi,

why don't you activate the PVE firewall for your container instead? you can use the GUI to set it up (Container -> Firewall -> Options -> change Firewall: No to Yes
and then Container -> Firewall -> Add/Enable rules as needed

to answer your question, the reason that the logs are not showing up in the container is probably because ufw logs are in dmesg or kern log, which cannot be accessed by the unprivileged container.