Hi, I'm trying to use a linux gateway/firewall with 2 nics (eth0 192.168.0.2 (goes to the modem (internet) on 192.168.0.1), and eth1 192.168.1.1) to be able to log traffic specifically from LAN IP addresses. The Router is a Netgear, and is configured on 192.168.1.2 to the firewall's eth1, and 192.168.2.1 as a gateway for the LAN respectively. The router has WIFI and Ethernet ports, and is on 192.168.2.0/24 with various clients. I the firewall only shows what it drops/logs from 192.168.1.2. I would like the firewall to be "aware" of each client on the router's LAN clients, so that when it drops a packet, it will also log which computer was sending/receiving the dropped packet.

[modem] [firewall] [router] [client(s)]

How would I be able to do this? Set up static routes? Also if so, how? I was playing with them yesterday, but couldn't figure out how they would work with my typology. If it matters, I am running iptables as a firewall + suricata as an inline IPS. I can post my iptables -L output if needed, as well as my route -n output.

Thanks in advance.

Just wanted to say I solved my issue.

If anybody is interested or has this issue: I ended up just plugging the gateway/firewall's ethernet cable into a port on the switch, then deploying the alternate gateway throughout the network. Router says there's no internet connection because I took the cable out of the yellow port, but that's ok; so long as it works. Now my firewall is aware of all the different machines on the LAN and can differentiate when dropping and logging bad traffic. Good deal.