0

I noticed that GUFW has the ability to turn logging on and off by rule, but I see no options with ufw -h that I can turn logging on for a rule

On ubuntu:

To                         Action      From
--                         ------      ----
Anywhere                   DENY IN     Anywhere                   (log-all)

But on Debian I try this command:

sudo ufw allow proto tcp from x.x.x.x to any port 22 log all

And it doesn't work... so is there some secret syntax thats not documented? Or is GUFW doing iptables rules separate from the core of UFW?

1

log-all should be hyphenated and after allow. The correct command is

sudo ufw allow log-all proto tcp from x.x.x.x to any port 22

replacing x.x.x.x with the intended IP.

Syntax

The syntax is documented on the man page.

 ufw [--dry-run] [rule] [delete] [insert NUM] [prepend] allow|deny|reject|limit [in|out [on
       INTERFACE]] [log|log-all] [proto PROTOCOL] [from ADDRESS [port PORT | app APPNAME  ]]  [to
       ADDRESS [port PORT | app APPNAME ]] [comment COMMENT]

A couple paragraphs at the very end of the section RULE SYNTAX explain how this works and provide a simpler example:

 ufw supports per rule logging. By default, no logging is performed when a packet matches a rule. Specifying log  will  log
 all  new connections matching the rule, and log-all will log all packets matching the rule.  For example, to allow and log
 all new ssh connections, use:

   ufw allow log 22/tcp

 See LOGGING for more information on logging.

Most keywords are optional, but the order is very rigid: the word log or log-all must go after the interface (on eth0, on wlo0, etc.). If the interface is not present, it must go after the action: allow/allow in/allow out/deny...

Placing the log keyword anywhere else will return the error Option log not allowed here.

How to update your rule

If you want to keep the rule but disable the logging, simply write the command again without the log-all keyword:

sudo ufw allow proto tcp from x.x.x.x to any port 22

ufw will recognise this and respond with `Rule updated` instead of `Skipping adding existing rule`.

This also works to add or remove comments to your rules:

sudo ufw allow log-all proto tcp from x.x.x.x to any port 22 comment 'incoming SSH'

Optional: logging need not be per-rule

You can also check the LOGGING section to log more information, for all rules (allowed packets as well):

sudo ufw logging off
sudo ufw logging low
sudo ufw logging medium
sudo ufw logging high
sudo ufw logging full

but the man page gently discourages setting the logging level over the default (low).

Unsolicited tips for your configuration

ufw has a separate syntax for default policies (that is, any connection which is not specifically mentioned in your ruleset). Your ruleset will be easier to understand and maintain if you replace your explicit "deny in from anywhere to anywhere" rule like this:

sudo ufw default deny incoming
sudo ufw delete deny from any

As long as the logging level is above low, ufw will log any blocked traffic. You can check the result with sudo ufw status verbose.

The Ubuntu wiki has pages on security, and you can check their recommended ufw configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.