dd--wrt klogd firewall rules

sigals's Avatar

sigals

11 Nov, 2018 07:20 AM

I made this, it works on my dd-wrt router you could tweak the regex pretty easily for different log formats though.

{
    "firewall": {
        "display": "firewall #1",
        "path": "/opt/var/log/messages",
        "format": {
            "multiline": "Error",
            "regex": "|(.{3}) ([0-9]{1,2}) ([0-9]{1,2}):([0-9]{1,2}):([0-9]{1,2}) (DD-WRT) (kernel:) (DROP) (IN=vlan2) (OUT=) (MAC=)(([0-9a-f]{2}[:])+([0-9a-f]{2})) (SRC=)((([0-9]{1,3}[.]))+[0-9]{1,3}) (DST=)((([0-9]{1,3}[.]))+[0-9]{1,3}) (.*) (PROTO=)([A-Z]{3}) (SPT=)([0-9]{1,8}) (DPT=)([0-9]{1,8}) (.*)|",
            "match": {
                "Date": [1, " ", 2, " ", 3, ":", 4, ":", 5],
                "Status": 8,
                "Interface": 9,
                "MAC": 12,
                "SRC": 16,
                "DST": 20,
                "Protocol": 25,
                "Source Port": 27,
                "Destination Port": 29,
                "Message": [23, 30]
            },
            "types": {
                "Date": "date:M d H:i:s \/100",
                "Status": "txt",
                "Interface": "txt",
                "MAC": "txt",
                "SRC": "ip:geo",
                "DST": "txt",
                "Protocol": "txt",
                "Source Port": "port",
                "Destination Port": "port",
                "Message": "txt"
            }
        }
    }
}

It matches the following log format:

Nov 11 02:56:15 DD-WRT kernel: DROP IN=vlan2 OUT= MAC=10:bf:48:e6:b3:a3:28:8a:1c:ea:af:40:08:00:45:00:00:28 SRC=92.24.227.58 DST=127.0.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=59184 DF PROTO=TCP SPT=36165 DPT=23 SEQ=3870276455 ACK=0 WINDOW=14600 RES=0x00 SYN URGP=0 
Nov 11 02:56:15 DD-WRT kernel: DROP IN=vlan2 OUT= MAC=10:bf:48:e6:b3:a3:28:8a:1c:ea:af:40:08:00:45:00:00:1c SRC=85.233.65.144 DST=127.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=232 ID=25958 PROTO=ICMP TYPE=8 CODE=0 ID=59598 SEQ=16529

Looks pretty sweet too.

Reply to this discussion

Internal reply

Formatting help / Preview (switch to plain text) No formatting (switch to Markdown)

Attaching KB article:

»

Already uploaded files

  • 2018-11-11_07_18_16-Pimp_my_Log__firewall__1_.png 82.6 KB

Attached Files

You can attach files up to 10MB

If you don't have an account yet, we need to confirm you're human and not a machine trying to post spam.

Keyboard shortcuts

Generic

? Show this help
ESC Blurs the current field

Comment Form

r Focus the comment reply box
^ + ↩ Submit the comment

You can use Command ⌘ instead of Control ^ on Mac

Recent Discussions

29 Nov, 2018 07:29 PM
11 Nov, 2018 07:20 AM
31 Oct, 2018 08:09 AM
28 Oct, 2018 05:43 PM
23 Oct, 2018 02:53 PM