Feb  7 18:40:09 slackware Shorewall:fw2net:REJECT: IN= OUT=eth0 MAC= SRC=192.168.1.2 DST=80.74.157.215 LEN=60 TOS=00 PREC=0x00 TTL=64 ID=9780 DF PROTO=TCP SPT=53951 DPT=80 SEQ=605321004 ACK=0 WINDOW=5840 SYN URGP=0 
Feb 12 16:18:04 slackware Shorewall:fw2net:REJECT: IN= OUT=eth0 MAC= SRC=192.168.1.2 DST=80.74.157.215 LEN=60 TOS=00 PREC=0x00 TTL=64 ID=33457 CE DF PROTO=TCP SPT=59616 DPT=80 SEQ=2020225075 ACK=0 WINDOW=5840 SYN URGP=0 


ULOG.conf
------------


# Example configuration for ulogd
# $Id: ulogd.conf.in 5267 2005-02-19 21:33:43Z laforge $
#

[global]
######################################################################
# GLOBAL OPTIONS
######################################################################

# netlink multicast group (the same as the iptables --ulog-nlgroup param)
nlgroup=1

# logfile for status messages
logfile="/var/log/ulogd.log"

# loglevel: debug(1), info(3), notice(5), error(7) or fatal(8)
loglevel=3

# socket receive buffer size (should be at least the size of the
# in-kernel buffer (ipt_ULOG.o 'nlbufsiz' parameter)
rmem=131071

# libipulog/ulogd receive buffer size, should be > rmem
bufsize=150000

######################################################################
# PLUGIN OPTIONS
######################################################################

# We have to configure and load all the plugins we want to use

# general rules:
# 1. load the plugins _first_ from the global section
# 2. options for each plugin in seperate section below


#
# ulogd_BASE.so - interpreter plugin for basic IPv4 header fields
# 		  you will always need this
plugin="/usr/lib/ulogd/ulogd_BASE.so"


# output plugins. 
plugin="/usr/lib/ulogd/ulogd_LOGEMU.so"
#plugin="/usr/lib/ulogd/ulogd_OPRINT.so"
#plugin="/usr/lib/ulogd/ulogd_MYSQL.so"
#plugin="/usr/lib/ulogd/ulogd_PGSQL.so"
#plugin="/usr/lib/ulogd/ulogd_SQLITE3.so"
#plugin="/usr/lib/ulogd/ulogd_PCAP.so"


[LOGEMU]
file="/var/log/ulogd.syslogemu"
sync=1

[OPRINT]
file="/var/log/ulogd.pktlog"

[MYSQL]
table="ulog"
pass="changeme"
user="laforge"
db="ulogd"
host="localhost"

[PGSQL]
table="ulog"
schema="public"
pass="changeme"
user="postgres"
db="ulogd"
host="localhost"

[SQLITE3]
table="ulog"
db="/path/to/sqlite/db"
buffer=200

[PCAP]
file="/var/log/ulogd.pcap"
sync=1


/etc/shorewall/policy


#
# Shorewall version 4.0 - Sample Policy File for one-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# See the file README.txt for further details.
#-----------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-policy"
###############################################################################
#SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
#
# Block this machine from accessing NET ZONE accept for exceptions in /etc/shorewall/rules
#$FW		net		REJECT          ULOG

# Allow NET Zone when not on VPN - (Allow all connection requests from the firewall to the Internet)
$FW             net             ACCEPT

# Allow this machine to access the VPN ZONE for everything
$FW             vpn             ACCEPT

# Block anything from the NET ZONE to all other zones - (Drop (ignore) all connection requests from the Internet to your firewall)
net		all		DROP		ULOG

# Block from using another connection
net             net             NONE

#
# The FOLLOWING POLICY MUST BE LAST
#

# Block everything else - (Reject all other connection requests (Shorewall requires this catchall policy)
all		all		REJECT		ULOG

#LAST LINE -- DO NOT REMOVE