host_firewall: optional nf_log_all_netns sysctl so the firewall logs of LXC guests reach the host kernel log

2026-10-24 13:43:12 +00:00
parent 88c30eb252
commit 5e544cdfb5
2 changed files with 14 additions and 0 deletions
@@ -27,6 +27,17 @@
    state: directory
    mode: "0755"

+# The kernel logs nft log statements of other network namespaces (LXC guests)
+# only with this sysctl; the lines land in the host kernel log.
+- name: Log the firewalls of container network namespaces
+  ansible.posix.sysctl:
+    name: net.netfilter.nf_log_all_netns
+    value: "1"
+    sysctl_file: /etc/sysctl.d/90-nf-log-all-netns.conf
+    sysctl_set: true
+    reload: false
+  when: firewall.log.all_netns
+
 - name: Install the systemd units
  ansible.builtin.copy:
    src: "{{ item }}"