Switch default logging backend from kernel to netfilter

[ddemchak1990]

Currently UFW's default logging configuration sends firewall events to the kernel log buffer. When a remote IP hits a blocked port, this L3 network event has no business being in kernel logs. Kernel logs should be reserved for actual kernel-level events - driver issues, module problems, hardware faults, memory errors, etc. The current default is architecturally wrong - it's like logging HTTP 404s to dmesg.

On busy production systems running for 1000+ days, the kernel buffer becomes polluted with thousands of network events. This makes it significantly harder to spot real kernel issues that need immediate attention. Finding a driver error in a sea of blocked port attempts is not just inconvenient - it's a reliability issue.

While UFW already has a netfilter backend fully implemented using NFLOG, it defaults to kernel logging. L3 network events don't belong in kernel logs - they should be in dedicated log facilities.

Proposed change:

diff --git a/conf/ufw.defaults b/conf/ufw.defaults
--- a/conf/ufw.defaults
+++ b/conf/ufw.defaults
@@ -20,7 +20,7 @@
 # Set the logging backend to use. If you change this, you will need to reload
 # the firewall for the changes to take effect.
 # - kernel - use the traditional LOG logging target
 # - netfilter - use the NFLOG logging target
-LOGGING_BACKEND="kernel"
+LOGGING_BACKEND="netfilter"

[ddemchak1990]

After testing the netfilter backend setting locally, I noticed something: with LOGGING_BACKEND="netfilter" set in /etc/default/ufw, I'm still seeing UFW entries in dmesg.

Looking at dmesg output:
[ timestamp ] [UFW BLOCK] IN=wlp0s20f3 OUT= MAC=... (etc)

Maybe I missed something in how this is supposed to work?

[ddemchak1990]

If I understand this code snippet correctly:

python
def get_all_logging_backends(self):
    """Return an instance of all the logging backends"""
    ret = []
    ret.append(ufw.kernel_log_backend.UFWLogBackendKernel())
    ret.append(ufw.netfilter_log_backend.UFWLogBackendNetfilter())
    return ret

UFW is logging to both places regardless of the LOGGING_BACKEND setting? This would explain why I'm still seeing kernel log entries even after switching to netfilter.