Add new rich rule target nflog, that allows to capture packages with ulogd

[frispete]

After a brief discussion with Eric Garver on the mailing list, he recommended to create this issue.

In order to be able to examine eg. discarded packages, we need some way to redirect these packages to another target, that allows further processing eg. with ulogd.

What's needed is a new target for rich rules, that allows to use a low precedence catch-all rich rule in order to be executed right before the accept/drop for the zone. e.g.

firewall-cmd --add-rich-rule='rule priority=32767 ... nflog prefix=.. group=..'

[gsgxnet]

Great you implemented this feature. Many thanks.

firewall-cmd --set-log-denied=<scope> with NFLOG as target is what I would like to get going.
As far as I know that would cover all zones. The rich rules available now would have to be defined for every (active) zone one by one, true?

For a zone i got a plain nflog going with:

firewall-cmd --zone=<myzone> --add-rich-rule='rule priority=32767 nflog'
success

Then inspect how this rule is setup in

nft list chain inet firewalld filter_IN_<myzone>_post
table inet firewalld {
        chain filter_IN_<myzone>_post {
                log group 0
        }
}

I already had figured that log group 0 seems to be the same as nflog. In the past I could not figure how to setup a rich rule with log to a specific group, would that have been possible?

[erig0]

@gsgxnet, check the man page firewalld.richlanguage. You can specify the group.

nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"] [limit value="rate/duration"]