3

I have a rule in my iptables which logs denied connections i.e. -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

I want a similar rule that logs all established i.e. non-denied connections to all ports. How can I do that, I have tried searching google and experimenting but I can not find the string to match

MadHatter
  • 78,442
  • 20
  • 178
  • 229
doesnt_matter
  • 65
  • 2
  • 6

1 Answers1

4

One cheap and cheerful way is to look for the second packet in the three-way handshake. It's easy to spot, as unusually it has both SYN and ACK flags set, which is generally unique to a given connection. Although it is still possible for the originator not to respond with the third and final packet, that's entirely by the grace of the originator: at this point, you have indicated that you're willing to have this conversation, and as far as you're concerned, it's established.

I logged those with 

iptables -A OUTPUT -p tcp --tcp-flags SYN,ACK SYN,ACK -j LOG --log-prefix "Connection established: "

And you can see it working with eg sshd:

client% telnet 192.168.3.1 22
Trying 192.168.3.1...
Connected to 192.168.3.1.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.3

server% tail -1 /var/log/facility/kern
Feb 18 05:06:29 server kernel: Connection established: IN= OUT=eth0.11 SRC=192.168.3.1 DST=192.168.3.11 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=22 DPT=59292 WINDOW=14480 RES=0x00 ACK SYN URGP=0

One quick note in passing: what you're currently logging is not denied connections, but denied packets; that's not the same thing. But I've assumed that you asked for precisely what you want, and have answered accordingly.

MadHatter
  • 78,442
  • 20
  • 178
  • 229
  • Thanks I will try that, Is there any use of logging established packets? I just want to see if any unauthorized connection is present – doesnt_matter Feb 18 '15 at 07:58
  • It depends on what kind of firewall policy you've got. If you go for the *everything-is-prohibited-except-what-I-have-allowed* firewall, then there shouldn't be any connections except those you've authorized. If you go for the *everything-is-allowed-except-what-I-have-prohibited* kind, then it will be very interesting to keep an eye on what's going on. But the latter kind of firewall isn't a good idea, see [this answer](http://serverfault.com/questions/232642/why-would-i-need-a-firewall-if-my-server-is-well-configured/232650#232650) for a more detailed discussion of the issue. – MadHatter Feb 18 '15 at 08:17
  • @MadHatter Will this in other word log only the ACCEPTED connections? or is there any better way to log the ACCEPTED connections? with a very simple way with out changing my current iptables (I mean by using the simplest solution because I am dealing with already created big iptables) – Mohammed Noureldin Dec 31 '16 at 01:12
  • @MohammedNoureldin yes, that is exactly what it should do. – MadHatter Dec 31 '16 at 07:43