Logging & the cleanup rule

Log what matters

Lesson 5 of 20 · 11 min · Module 2: Rule sets you can maintain

A firewall that blocks silently gives you nothing to work with when someone asks what happened.

Free. No installation: you write and run the code in your browser, and it is checked automatically.

By the end, you’ll be able to…

Decide which rules deserve a log entry
Write an explicit cleanup rule
Keep the cleanup rule in last position

The idea

Adding log to a rule records every packet that rule decides. The implicit deny usually records nothing, so many administrators end the policy with an explicit cleanup rule: deny any from any to any log. It changes no verdict; it makes the blocked traffic visible.

allow tcp from 10.0.5.7 to 10.0.6.0/24 port 3389 log
deny any from any to any log

01Choose what to record

Log the traffic you will be asked about: administrative access, and everything that was denied. Logging every allowed web request fills the disk and hides the entries that matter, so high-volume allow rules are often left unlogged or sampled.

02End with a cleanup rule

The cleanup rule matches every packet, so it must be the last rule: anything placed below it can never match. Because the default is already deny, the rule exists only for its log keyword.

03Logging on real devices

The idea is the same everywhere; the switch has a different name on each product.

# nftables: log, then drop, at the end of the chain
nft add rule inet filter forward log prefix "fw-drop: " drop

# FortiGate: per policy, and for the implicit deny
config firewall policy
    edit 5
        set logtraffic all
    next
end
config log setting
    set fwpolicy-implicit-log enable
end

# Huawei USG: inside a security-policy rule
 rule name admin_ssh
  policy logging
  session logging

Your turn

Add two rules below the existing one. First: the administrator (admin) may use SSH (tcp 22) to servers, and that access is logged. Last: a cleanup rule that denies and logs everything else.

What the checks look for

Administrator SSH is allowed and logged
Blocked attempts are recorded
The cleanup rule is last and matches everything
Staff still reach the website

Try it in the editor →

Take this with you

Log administrative access and denied traffic. An explicit, logged cleanup rule at the end shows you what the firewall is refusing.

Go a little further

Add log to the website rule as well, then think about how many entries one office would write on a normal working day.