help - log iptables

[Flavio A. Reis]

Hello,
friends, you can log into all that iptables is being blocked without logging
rules ACCEPT.
Example:
My Firewall has only opened the ports (80, 443, 53).
You can log all other connection attempts?
Thanks
att

[Bjoern Meier]

hi,

Post by Flavio A. Reis
Hello,
friends, you can log into all that iptables is being blocked without logging
rules ACCEPT.
My Firewall has only opened the ports (80, 443, 53).
You can log all other connection attempts?
Thanks
att

sure.
- Set Default Policy for INPUT to DROP
- Create Rule for ACCEPT 80,443,53
- Append logging Rule (if the packets end here, it will be dropped);
maybe with Prefix "DROP:"
- change logrotate rules (you will get a lot of log entries).

Greetings,
Björn

[Remzi AKYÜZ]

example;

iptables -A INPUT -j allow
iptables -A INPUT -j LOG --log-prefix="Dropped :"

iptables -N allow
iptables -A allow -p tcp -m multiport --dports http,https,domain -m
conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A allow -p udp --dport 63

iptables -P INPUT DROP


you see log via dmesg or syslog.

Post by Bjoern Meier
hi,

Post by Flavio A. Reis
Hello,
friends, you can log into all that iptables is being blocked without logging
rules ACCEPT.
My Firewall has only opened the ports (80, 443, 53).
You can log all other connection attempts?
Thanks
att

sure.
- Set Default Policy for INPUT to DROP
- Create Rule for ACCEPT 80,443,53
- Append logging Rule (if the packets end here, it will be dropped);
maybe with Prefix "DROP:"
- change logrotate rules (you will get a lot of log entries).
Greetings,
Björn

[Flavio A. Reis]

*thank you Remzi
*

Post by Remzi AKYÜZ
iptables -A INPUT -j allow
iptables -A INPUT -j LOG --log-prefix="Dropped :"
iptables -N allow
iptables -A allow -p tcp -m multiport --dports http,https,domain -m
conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A allow -p udp --dport 63
iptables -P INPUT DROP