"Eric Wolzak" <[EMAIL PROTECTED]> writes: > > Of course weblet is still doing something I consider wrong -- it's saying > > the firewall is in red light / "ERROR" mode just because it has "251 denied > > or rejected packets". Isn't this the whole point of a firewall, to deny and > > reject those packets? How is this an "ERROR"? At worst, it should be at > > "yellow alert". > This depends on what you log and in what environment you are. > On some of my internal boxes 251 would be a whole lot :)
Right, but I'm sure the vast majority of LEAF installations are exposed to the Internet, not sequestered on some internal network. > You can change the settings for your individual system in > 3) Packages configuration > Weblet > > 2) LRP web page configuration > > > # Warning/Error thresholds for the weblet utility > # Disable checking of any value by setting it to -1 > > # Firewall thresholds: deny/reject messages > WRN_FW=5 > ERR_FW=50 > > WRN_FW is the number of logged packets after which the color > changes to yellow > > ERR_FW is the number of logged packets to change to red Thanks, I hadn't noticed those parameters. The default values do seem unreasonably low, if most people are using LEAF on the Internet. But I guess I don't really agree with the design philosophy in general. How many packets on an Internet-facing firewall is the right number to be considered an "ERROR"? To me, going to red-light mode just because there are a lot (however you define "a lot") of denied and rejected packets means that you're crying wolf, and conditions people not to click on the red light to find out what's wrong. I think the "ERROR" case should be saved for when things are seriously wrong, like the firewall is failing to process packets, or all rules have been cleared, or things of that nature. Again, I'm perfectly happy with the use of the yellow light to indicate a "high" number of denied/rejected packets, just not with the use of the red light to indicate "even more" of them. -- Dan Harkless [EMAIL PROTECTED] http://harkless.org/dan/ ------------------------------------------------------- This sf.net email is sponsored by: Dice - The leading online job board for high-tech professionals. Search and apply for tech jobs today! http://seeker.dice.com/seeker.epl?rel_code=31 ------------------------------------------------------------------------ leaf-user mailing list: [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
