Page MenuHomeVyOS Platform
Create Task
Maniphest T6362

Create a conntrack/translations logger daemon
Needs testing, WishlistPublicFEATURE REQUEST
Actions

Description

Create a conntrack/translations logger daemon.
The daemon should listen to netlink updates directly, parse them, get and log required data.

It should be reusable for CGNAT and other services.

Good to have for CGNAT next info for the NEW packets/flow:

  • Timestamp
  • Original internal source address and port (before NAT)
  • External source address and port (after NAT)
  • Destination address and port

Needs to think about the format of the file with log data.

Details

Difficulty level
Unknown (require assessment)
Version
-
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible
Issue type
Feature (new functionality)

Related Objects
Search...

StatusSubtypeAssignedTask
 Needs testingFEATURE REQUESTNoneT5169 Add CGNAT Carrier-Grade NAT based on nftables
 Needs testingFEATURE REQUESTHollyGurzaT6362 Create a conntrack/translations logger daemon

Event Timeline

Viacheslav created this task.May 17 2024, 10:39 AM
Viacheslav triaged this task as Wishlist priority.
Viacheslav added a parent task: T5169: Add CGNAT Carrier-Grade NAT based on nftables.
Viacheslav added a subscriber: n.fort.
n.fort added a comment.May 17 2024, 10:53 AM

Related to https://vyos.dev/T5471 ?

pasik subscribed.May 17 2024, 12:01 PM
HollyGurza claimed this task.Jul 1 2024, 8:37 AM
HollyGurza added a comment.Jul 18 2024, 5:52 AM

https://github.com/vyos/vyos-1x/pull/3804

HollyGurza changed the task status from Open to Needs testing.Jul 30 2024, 8:01 AM
csszep subscribed.Jul 30 2024, 8:14 AM

Hi!

I am not against the Python implementation, but why isn't ulogd2 simply used for this?

csszep added a comment.EditedJul 30 2024, 8:38 AM

Hi!

I have a related question too.

I can configure a firewall rule to log userspace via nflog.

set firewall ipv4 forward filter rule 22 log
set firewall ipv4 forward filter rule 22 log-options group '0'

Which is translated to nft rule:

ip daddr 2.2.3.22 tcp dport 1022 ip saddr 1.2.3.22 log prefix "[ipv4-FWD-filter-22-A]" log group 0 counter packets 0 bytes 0 accept comment "ipv4-FWD-filter-22"

But after commit nothing is listen in userspace for nflog group 0 in vyos.

Wouldn't it be more consistent to use ulogd2 for both packet and conntrack (and flow) level logging?