0

[majkronnie-lang]

After testing the netfilter backend setting locally, I noticed something: with LOGGING_BACKEND="netfilter" set in /etc/default/ufw, I'm still seeing UFW entries in dmesg.

Looking at dmesg output:

[ timestamp ] [UFW BLOCK] IN=wlp0s20f3 OUT= MAC=... (etc)

Maybe I missed something in how this is supposed to work?

Originally posted by @ddemchak1990 in #4

[ddemchak1990]

Maybe I missed something in how this is supposed to work?

No — it doesn't work. It should.

I've pulled UFW off production boxes specifically because of this. When you're watching dmesg trying to catch a kernel
oops or a driver fault, it's wall-to-wall [UFW BLOCK] entries. Completely destroys the signal. I kept moving on
without digging into why until now.

After looking at the source: there is no way to tell UFW to stop using the kernel log. The option doesn't exist.

Your choices are:

• ufw logging off — disables all logging; no -j LOG rules are inserted
• any other level (low/medium/high/full) — all hardcode -j LOG, kernel gets everything

The -j LOG target is baked in throughout src/backend_iptables.py with no abstraction around it. _get_logging_rules()
(~line 1131–1177) builds every logging chain rule with -j LOG unconditionally, no config key driving it. Same for the
rate-limit rule in init (~line 65) and a spot in _get_lists_from_formatted.

The fix is straightforward in principle. _get_defaults() in backend.py already reads all key=value pairs from the
defaults file generically, so adding LOGGING_BACKEND=kernel to conf/ufw.defaults would populate
self.defaults['logging_backend'] automatically. From there, _get_logging_rules and the limit rule just need to
conditionally emit -j NFLOG --nflog-prefix instead of -j LOG --log-prefix when set to netfilter.

It's not a large change. It just hasn't been done — which means the config knob this issue is requesting has never
existed on any installation.