[gsanchietti]

When a client cannot reach something, administrators have to guess which part of the firewall is blocking it. The new Monitoring > Live trace page traces one client IP address for a limited time and shows which layer blocked each new connection: a firewall rule or zone policy, Threat Shield IP block lists, DPI (deep packet inspection) rules, the DNS filter or MAC binding.

The page starts a session with an IP address, a duration and an optional port and protocol filter, then refreshes every 2 seconds. While the session runs it lists the blocked connections, the routing warnings, the DNS queries and the live connections. After the session ends the results stay visible, together with the allowed connections of the session.

• Blocked connections show the layer, the rule and the interfaces. A firewall rule name shows the rule details and a link to Firewall rules
• Connections can be filtered by text, application, protocol, source, destination and status
• The page warns when some traffic was not traced and tells why a session ended
• Texts, colors and components follow the Nebula Design System. The page is translated in English and Italian

Screenshots

A session for a client in a zone that drops traffic to the firewall: the banner, the blocked connections with their layer and rule, and a private address sent to the WAN.

DNS queries with their result, and the live connections with application, interfaces and accepting rule.

After the session ends: the results stay visible, with the allowed connections of the session.

How to test

• Install an image built from feat(ns-api): add live trace troubleshooting API nethsecurity#2007, which provides the ns.livetrace API and builds this branch
• Open Monitoring > Live trace, enter the IP address of a client and start a session
• From the client, open a connection blocked by a firewall rule and query a domain blocked by the DNS filter: the page lists the block with its layer and rule name, and the DNS query as blocked
• Move to the rule name with the mouse or the Tab key: a tooltip shows the rule details and the "Go to Firewall rules" link
• Type a text that matches no connection in the filter: the page shows "No connections found" and a "Reset filters" button that brings the connections back
• Enter port 0 or 70000: the page shows "Invalid port number" and does not start a session
• Stop the session: the results stay visible and the allowed connections are listed with the rule that accepted them
• Start a session and run nft delete table inet ns_livetrace on the firewall: the page shows "Live trace session stopped unexpectedly", with the reason under "Show details"

See also

• feat(ns-api): add live trace troubleshooting API nethsecurity#2007

---

Generated by Claude Code:claude-haiku-5-5 with nethserver-pr