add proxmox firewall iptables parser

[aderumier]

This add proxmox iptables specific iptables logformat
-j NFLOG --nflog-prefix '$vmid:$loglevel:$chain: $msg'

[nameduser0]

Thanks for this. A couple of naive questions:

So does this deal with DROPs for all VM and container firewall traffic or just the host traffic?
And does the log_level need to be set to something other than nolog somewhere to capture drops?

[aderumier]

It'll deal with both host && vm firewall.

it's the same format, only the iptables chain is different (.... HOST-IN .... , ....TAP-IN, ....).
the grok pattern is catching both correctly.

the log_level need indeed to be different than "nolog" to be logged in /var/log/pve-firewall.log

[he2ss]

Hi @aderumier,

Thanks for the contribution.
Could you please add tests for this parser, using (cscli hubtest)[https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest/]. It will generate suite tests config.

[aderumier]

@he2ss

yes sure. I'm a bit busy this week, I'll send tests next week.

Thanks !

[aderumier]

@he2ss

I have added tests and also fix the parser (thanks to the tests ;)