Page MenuHomeVyOS Platform

Nat log - Add translated data to nat logs
Open, LowPublicFEATURE REQUEST

Description

Currently, enabling log on a nat rule gives us a log like this:

Feb 14 12:26:08 kernel: [NAT-SRC-10] IN= OUT=eth0 SRC=198.51.100.155  DST=OTO=TCP SPT=51  LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=24552 DF PROTO=TCP SPT=51048 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0

New requirement: also expose translated address/port on logs

Details

Difficulty level
Unknown (require assessment)
Version
-
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)

Event Timeline

I think it is necessary to show this kind information . it should use tools/service as netflow/ipfix . for example:

https://tools.ietf.org/id/draft-ietf-behave-ipfix-nat-logging-02.html

I don't know if nftable is able to show all the information in log message.

Unknown Object (User) added a subscriber: Unknown Object (User).Feb 14 2022, 8:17 PM

@n.fort it is possible with conntrackd logging option syslog

sudo rm /etc/systemd/system/conntrackd.service.d/override.conf

edit nano /etc/conntrackd/conntrackd.conf and add Syslog on in General section, then restart conntrackd service.
After that you will get messages

conntrack-tools[5097]: udp      17 src=100.64.0.3 dst=1.1.1.1 sport=41900 dport=53 src=1.1.1.1 dst=198.51.100.1 sport=53 dport=41900
Unknown Object (User) added a subscriber: Unknown Object (User).Feb 23 2022, 1:29 AM

Confirm successful sending of syslog messages with NAT broadcasts. It is not information about every packet that is sent, it is information about the entry in the conntrack table. Therefore it takes some time before the syslog messages are visible.

  1. delete the file:
sudo rm /etc/systemd/system/conntrackd.service.d/override.conf
  1. edit the file by adding the "Syslog on" in "Global" and "Stats" section options there:
sudo nano /etc/conntrackd/conntrackd.conf
General {
        Syslog on
...............
Stats {
        Syslog on
}
  1. Restart conntrackd:
sudo systemctl restart conntrackd
  1. As a result you will get similar Syslog messages:
Feb 15 01:43:15 vyos conntrack-tools[14444]: icmp     1 src=10.0.0.2 dst=8.8.8.8 type=8 code=0 id=3711 src=8.8.8.8 dst=192.168.255.6 type=0 code=0 id=3711
Feb 15 01:43:15 vyos conntrack-tools[14444]: icmp     1 src=10.0.0.2 dst=1.1.1.1 type=8 code=0 id=3686 src=1.1.1.1 dst=192.168.255.6 type=0 code=0 id=3686