From 8e739d5240f6603aae859a5a9e99bf3476fdb203 Mon Sep 17 00:00:00 2001
From: Adam Harrison <harrisonadamw@gmail.com>
Date: Fri, 14 Oct 2016 15:59:15 +0100
Subject: [PATCH] Log dropped policy controller traffic via NFLOG

Send blocked NEW connection attempts to NFLOG group 86 for accounting by
the weave-npc process.
---
 weave | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/weave b/weave
index 8510d8c7..f82f9ccd 100755
--- a/weave
+++ b/weave
@@ -601,7 +601,7 @@ create_bridge() {
             # Steer traffic via the NPC
             run_iptables -N WEAVE-NPC >/dev/null 2>&1 || true
             add_iptables_rule filter FORWARD -o $BRIDGE -j WEAVE-NPC
-            add_iptables_rule filter FORWARD -o $BRIDGE -j LOG --log-prefix=WEAVE-NPC:
+            add_iptables_rule filter FORWARD -o $BRIDGE -m state --state NEW -j NFLOG --nflog-group 86
             add_iptables_rule filter FORWARD -o $BRIDGE -j DROP
         else
             # Work around the situation where there are no rules allowing traffic