mjhjmtu

I'm running Fedora 20 and would like to see what my firewall is doing in the background. Is it possible to view a log of the traffic blocked by FirewallD?

According to this page, the FirewallD logs are at /var/log/firewalld. To get debug messages, you need to run it with --debug or --debug=2.

I know this is a dated post, but I've been searching for this today, and have found tons of old blogs that attempt to address this issue. For the public, this update from Red Hat should be more available than only to subscribers:

Upgrade to firewalld-0.4.3.2-8.el7 from Errata RHSA-2016:2597

Specify which packets should be logged

firewall-cmd --set-log-denied=<value>

value may be one of: all, unicast, broadcast, multicast, or off

Source: https://access.redhat.com/solutions/1191593

You need append the line in /etc/sysconfig/firewalld

for maximum details:

FIREWALLD_ARGS=--debug=10

Then restart firewalld service

sudo systemctl restart firewalld

It's better, than edit /usr/lib/systemd/system/firewalld.service.

For logging the traffic blocked by firewalld, the following approach with rsyslogd worked for me:

Edit /etc/sysconfig/firewalld and update the value for LogDenied to all (or as required)

LogDenied=all

restart firewalld

sudo systemctl restart firewalld

This typically adds logging rules just before reject/drop rules in the firewall, something like:

LOG all -- anywhere anywhere LOG level warning prefix "IN_drop_DROP: "
LOG all -- anywhere anywhere LOG level warning prefix "FINAL_REJECT: "

Create a file named /etc/rsyslog.d/custom_iptables.log and add the following statements to it:

:msg,contains,"_DROP" /var/log/iptables.log
:msg,contains,"_REJECT" /var/log/iptables.log
& stop

restart rsyslog

sudo systemctl restart rsyslog 

Now the dropped and rejected packets will be logged to /var/log/iptables.log