diff --git a/Shorewall/Perl/Shorewall/Compiler.pm b/Shorewall/Perl/Shorewall/Compiler.pm index 5abc6c0bd..e654e6181 100644 --- a/Shorewall/Perl/Shorewall/Compiler.pm +++ b/Shorewall/Perl/Shorewall/Compiler.pm @@ -743,7 +743,7 @@ sub compiler { setup_source_routing($family); - setup_log_backend; + setup_log_backend($family); # # Proxy Arp/Ndp # diff --git a/Shorewall/Perl/Shorewall/Config.pm b/Shorewall/Perl/Shorewall/Config.pm index 6c76369d3..0ede13ab2 100644 --- a/Shorewall/Perl/Shorewall/Config.pm +++ b/Shorewall/Perl/Shorewall/Config.pm @@ -5750,7 +5750,7 @@ sub get_configuration( $$$$$ ) { if ( defined( $val = $config{LOG_BACKEND} ) ) { if ( $family == F_IPV4 && $val eq 'ULOG' ) { - $val = 'xt_ULOG'; + $val = 'ipt_ULOG'; } elsif ( $val eq 'netlink' ) { $val = 'nfnetlink_log'; } elsif ( $val eq 'LOG' ) { diff --git a/Shorewall/Perl/Shorewall/Proc.pm b/Shorewall/Perl/Shorewall/Proc.pm index 49ec7e602..71448e4de 100644 --- a/Shorewall/Perl/Shorewall/Proc.pm +++ b/Shorewall/Perl/Shorewall/Proc.pm @@ -349,17 +349,22 @@ sub setup_interface_proc( $ ) { } } -sub setup_log_backend() { +sub setup_log_backend($) { if ( my $setting = $config{LOG_BACKEND} ) { - my $file = '/proc/sys/net/netfilter/nf_log'; + my $family = shift; + my $file = '/proc/net/netfilter/nf_log'; + my $ctl = 'net.netfilter.nf_log.' . ( $family == F_IPV4 ? '2' : '10' ); - emit( "if -f $file; then", - " if echo $setting > $file; then", + emit( 'progress_message2 "Setting up log backend"', + '', + "if [ -f $file ]; then", + " if sysctl $ctl=$setting; then", " progress_message 'Log Backend set to $setting'", - " else", - " error_meessage 'WARNING: Unable to set log backend to $setting'", - "else", - " error_message 'WARNING: $file does not exist - log backend not set", + ' else', + " error_message 'WARNING: Unable to set log backend to $setting'", + ' fi', + 'else', + " error_message 'WARNING: $file does not exist - log backend not set'", "fi\n" ); } } diff --git a/docs/shorewall_logging.xml b/docs/shorewall_logging.xml index 81e22f44a..6f202d3a1 100644 --- a/docs/shorewall_logging.xml +++ b/docs/shorewall_logging.xml @@ -382,7 +382,7 @@ ACCEPT:NFLOG(1,0,1) vpn fw tcp ssh,time,631,8080 Example - change the IPv4 backend to LOG: - echo ipt_LOG > /proc/net/netfilter/nf_log.2 + sysctl net.netfilter.nf_log.2=ipt_LOG Beginning with Shorewall 4.6.4, you can configure the backend using the LOG_BACKEND option in