Injoy logging

[Andi B.]

I've a user filter like this -

Code: [Select]

Deny_Pana_TV
Comment = "verhindere alles 192.168.1.199",
Source = "192.168.1.199",
Direction = Outgoing,
        Log-Severity = None,
Log-Control = Disabledwhich blocks connections from this device to the internet. But now the Injoy GUI 'Dropped Packets' and 'Rejected Connections' windows are full of log messages from this client. Can I prevent logging output of this rule? 'Log-Control = Disabled' does not help.

I'm glad that Injoy drops packets from this client but as the window is full of these messages the important ones are hard to find now.

[Ian B Manners]

Hi Andi,

You should not need the logging lines even in the negative.
What version of IJFW are you using ?

You might also have to look into your default ruleset in your Security Level file, I normally just use the default logging rules, you might
have log everything on. (Firewall-Security Level- click on the Custom button,  then the 'System Rules' tab.

[Andi B.]

You should not need the logging lines even in the negative.

I added it as I hoped the will prevent logging but they don't.

What version of IJFW are you using ?

4.1 although the About window says 4.0. But think there's not much difference except one fix....

You might also have to look into your default ruleset in your Security Level file, I normally just use the default logging rules, you might
have log everything on. (Firewall-Security Level- click on the Custom button,  then the 'System Rules' tab.

I've set Security Level 5 and as far as I remember not changed the System Rules. There's 'Log rejected packets' which is correct. But now I discovered 'Edit Rule File...' means edit 'last selected list box entry' rule file. Never seen that before. Maybe I can deselect logging for my special IP address. Have to play with it....

If there is a possibility to negate an IP address it would be easy. Means I like to set 'Any' but except 192.168.1.199

Unfortunately documentation is not very helpful. They say more detailed information is in 'Injoy Securitity Guide' but my version shows not much more than headers without much information. :-(

[Ian B Manners]

Hi Andy,

v4.1 is good, makes it easier to help
I started with Level 8 but that probably bares next to no resemblance now, I've edited the individual files to suit my server and needs far beyond.


Note that in a level config, if the line is highlighted (white lettering on grey background), that rule is active, if the line is clear (black text on white background), it is inactive.


Re the manuals, yes, I think I only read them once, then figured it out by trial and error. With a firewall, I think it is a big ask to write an indepth manual considering no two configs are likely to be identical but a couple of pointers would have been nice.

But now the Injoy GUI 'Dropped Packets' and 'Rejected Connections' windows are full of log messages from this client. Can I prevent logging output of this rule? 'Log-Control = Disabled' does not help.

Do you have the rule in blacklst.cnf or firerule.cnf ?
It should be in blacklst.cnf as a deny rule.

Bare basic rule in blacklst.cnf with logging unticked should work.


(Note, I'm trying to figure out image stuff so this might take some editing to get right)

[Andi B.]

Do you have the rule in blacklst.cnf or firerule.cnf ?
It should be in blacklst.cnf as a deny rule.

I had it in 'User Rules..' and now changed it to 'Blacklist' as you suggested. Guess it will show up in 'Blacklist Log' window now. But probably only one line which will be okay for me. Now let's see how it works. Thanks for your assistant.

Re the manuals, yes, I think I only read them once, then figured it out by trial and error. With a firewall, I think it is a big ask to write an indepth ...

Agree. But f.i. I searched for rule setting 'Passive' and did not even found that one although I think I read it somewhere long ago. 'Enable' and 'Disable' are clear but what means 'Passive'?

[Ian B Manners]

Hi Andy,

'Enable' and 'Disable' are clear but what means 'Passive'?

Don't know, I'll look it up in the manual ;-)