firewalltailer

Firewalltailer is a software tool that requires a fair amount of configuration to get things set up properly, but once configured, it requires very little ongoing maintenance. To get started, you'll first need to make sure that your iptables logs are configured with the proper prefixes for blocked and dropped traffic. This includes prefixes for blocked incoming, blocked outgoing, blocked forwarding in, blocked forwarding out, dropped incoming (internal interface), dropped incoming (external interface), rejected outgoing (internal interface), rejected outgoing (external interface), rejected forwarding in, and rejected forwarding out. If you're using qFirewall, these prefixes are already set up for you.

After configuring the iptables prefixes, you'll need to open up firewalltailler in a text editor and configure the color coding and text replacement for the output. Examples are provided to make this process easier. You'll also need to toggle $doDNS to 1 or 0 depending on whether you want DNS lookups for local IPs. Once everything is configured, simply exit the text editor and run the program.

Overall, because of the setup involved, Firewalltailer may not be the best choice for casual users or those who don't have the time or patience to configure it properly. However, for more advanced users who are willing to put in the effort, it can be a powerful tool for monitoring firewall traffic and identifying potential issues.