I have a Debian 9.1 installation I'm using as a NAT router. Shorewall version, linux kernel version 4.9+80+deb9u1. There are two network interfaces. The routing functions are all working correctly.

I would like to log connections and rejections to a log file, but not via syslog, as everything else goes there. I've read http://shorewall.org/shorewall_logging.html and followed it as well as I may, and other documents I've found are all about peripheral cases. However, my ulog log file is empty, and netfilter msgs are still going to /var/log/kern.log.

here are some excerpts from relevant config files:






ACCEPT:$LOG          loc                        $FW                        tcp     5509
ACCEPT:$LOG          net                        $FW                        tcp     5509
ACCEPT               loc                        $FW                        udp     53
ACCEPT               loc                        $FW                        tcp     53

the /etc/ulogd.conf is stock, it's the same as from /usr/share/doc/ulogd2/examples/ulogd.conf.gz

I'm not getting any compilation errors when I run shorewall restart, and, as in the rules sample above, I am getting syslog messages for connections to 5509, but not 53. The log entries are just going to the wrong place.

What am I doing wrong ?

1 Answer 1


According to man shorewall.conf

    This parameter tells the /sbin/shorewall program where to look
    for Shorewall messages when processing the dump, logwatch, show
    log, and hits commands.

So changing this parameter does not affect the place where your firewall will write its log messages to.

If you want to configure Shorewall to direct Netfilter messages to a log facility other than syslog, you might want consult man shorewall-logging for the various options to achieve this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .