host_firewall: optional nf_log_all_netns sysctl so the firewall logs of LXC guests reach the host kernel log

2026-10-24 13:43:12 +00:00
parent 88c30eb252
commit 5e544cdfb5
2 changed files with 14 additions and 0 deletions
@@ -51,6 +51,9 @@ firewall:
  log:
    in_rate: "5/second burst 30 packets"
    out_rate: "6/minute burst 5 packets"
+    # Lets the kernel log the nft log statements of container network
+    # namespaces (LXC guests) into the host kernel log.
+    all_netns: false
  # Reject outbound TCP 25; the mail group turns it off.
  block_smtp_out: true
  # EU-27 plus CH, NO, GB, IS, LI (ipdeny country codes). Empty leaves the geo