Default Firewall Rules Log by Default?

Started by PhYrE, Today at 02:15:05 AM

Previous topic - Next topic
The default firewall rules has a `let out anything from firewall host itself` and `let out anything from firewall host itself (force gw)`.  These have logging on by default (Firewall | Settings | Advanced | Logging -> Log packets matched from the default pass rules).

Is there any reason this is on by default?  Is there any reason this should stay on (or be on by default)?
Is the best choice to turn off this log once we know things are working?
Is the best choice just to add a manually-placed explicit rule that does the same thing but without logging?

If I understand correctly, this will effectively log every connection out from OPNsense, at a period where the docs say that there is limited log space available. 

If there any way to just make these still log but log to memory?  I'm fine with the logging, but don't want to wear out the SSD with writes.

Any guidance is appreciated.  Just surprised such a log heavy option was on by default.

Logging is up to you. I prefer to log everything... almost. pf's in-and-out traversal logging is a bit odd, so I've tried limiting that a bit.

As to your SSD, here's mine after about 10 months of use:

=== START OF SMART DATA SECTION ===
[...]
Data Units Read:                    71,275 [36.4 GB]
Data Units Written:                1,866,966 [955 GB]
[...]

This is on a link with static IPs (and associated public servers), so it runs 200-5000 active sessions. Note that I do not run an IPS. Some folks have seen much higher write loads. I keep 200 log files, and they're practically unsearchable (very slow). I need to look at the ZFS compression settings, because the file system appears to be unbelievably well compressed.