EnvironmentRed Hat Enterprise Linux 7Red Hat Enterprise Linux 8Red Hat Enterprise Linux 9IssueHow to log all inbound and outbound traffic using firewalld ?How to log all incoming traffic before applying blocking rules ?ResolutionAdd the following firewalld direct rules to monitor incoming trafficRaw# firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Incoming_Traffic --log-level 4 # firewall-cmd --reloadAdd the following firewalld direct rules to monitor outgoing trafficRaw# firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Outgoing_Traffic --log-level 4 # firewall-cmd --reloadUse the below command to verify the direct ruleRaw# firewall-cmd --direct --get-all-rulesNote:Direct rules are given a higher precedence than all other firewalld rulesDiagnostic StepsExample output of direct rulesRaw# firewall-cmd --direct --get-all-rules ipv4 filter INPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Incoming_Traffic --log-level 4 ipv4 filter OUTPUT 0 -p all -s 0.0.0.0/0 -j LOG --log-prefix Outgoing_Traffic --log-level 4Example output of incoming traffic logs:Raw# tail -f /var/log/messages |grep Incoming_Traffic May 17 08:46:17 vm003 kernel: Incoming_TrafficINens192 OUT MAC00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC192.16.100.40 DST192.16.100.20 LEN104 TOS0x00 PREC0x00 TTL128 ID21890 DF PROTOTCP SPT63559 DPT22 WINDOW1025 RES0x00 ACK PSH URGP0 May 17 08:46:17 vm003 kernel: Incoming_TrafficINens192 OUT MAC00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC192.16.100.40 DST192.16.100.20 LEN104 TOS0x00 PREC0x00 TTL128 ID21891 DF PROTOTCP SPT63559 DPT22 WINDOW1025 RES0x00 ACK PSH URGP0 May 17 08:46:17 vm003 kernel: Incoming_TrafficINens192 OUT MAC00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC192.16.100.40 DST192.16.100.20 LEN104 TOS0x00 PREC0x00 TTL128 ID21892 DF PROTOTCP SPT63559 DPT22 WINDOW1024 RES0x00 ACK PSH URGP0Example output of outgoing traffic logs:Raw# tail -f /var/log/messages |grep Outgoing_Traffic May 22 19:56:50 vm003 kernel: Outgoing_Traffic IN OUTens192 SRC192.16.100.20 DST192.16.100.40 LEN120 TOS0x08 PREC0x40 TTL64 ID23391 DF PROTOTCP SPT22 DPT56984 WINDOW503 RES0x00 ACK PSH URGP0 May 22 19:56:50 vm003 kernel: Outgoing_Traffic IN OUTens192 SRC192.16.100.20 DST192.16.100.40 LEN120 TOS0x08 PREC0x40 TTL64 ID23392 DF PROTOTCP SPT22 DPT56984 WINDOW503 RES0x00 ACK PSH URGP0 May 22 19:56:50 vm003 kernel: Outgoing_Traffic IN OUTens192 SRC192.16.100.20 DST192.16.100.40 LEN120 TOS0x08 PREC0x40 TTL64 ID23393 DF PROTOTCP SPT22 DPT56984 WINDOW503 RES0x00 ACK PSH URGP0