Is it possible log all dropped connections by IPTables and set a iptables.log file for logging in /var/log/?
Asked
Active
Viewed 1.3k times
2 Answers
9
You can do this my configuring iptables to 'mark' the messages e.g.
iptables -A INPUT -s 192.0.2.0/24 -j LOG --log-prefix='[iptables] '
Which will cause a log message that is prefixed with the text [iptables]
Now you can configure your rsyslog to send these messages to a particular log file by adding a suitable entry to it's configuration e.g.
:msg,contains,"[iptables] " /var/log/iptables.log
user9517
- 114,104
- 20
- 206
- 289
0
there is a way to log packets in IPTables. first you need to create new chain to logging packets.
iptables -N LOGGING
then you need to append which packets you are gonna log using following commands.
iptables -A INPUT -j LOGGING
iptables -A OUTPUT -j LOGGING
now you can log the packets to the syslogs using this.
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
finally this command.
iptables -A LOGGING -j DROP
please add this new lines to bottom of your IPTables files.
Shyamin Ayesh
- 11
- 3
-
But where will it be logged? Where can I find the log file? – Jan 29 '16 at 16:44
-
They are logged in kern.log by default. but you can change this in your syslog server configuration. – Dom Jan 29 '16 at 19:24