Firewall log dropped
This explains how to log dropped packets. This is a summary of both excellent articles:
- "The geek stuff" - http://www.thegeekstuff.com/2012/08/iptables-log-packets/
- "Networking howtos" - http://www.networkinghowtos.com/howto/change-the-iptables-log-file/
Log all dropped packages
Edit your iptables script, add the following part at the end:
iptables -N LOGGING iptables -A INPUT -j LOGGING iptables -A OUTPUT -j LOGGING iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "iptables - dropped: " --log-level 4 iptables -A LOGGING -j DROP
Log specific events
You can log specific events in an INPUT, OUTPUT or FORWARD chain.
IPTABLES=`which iptables` $IPTABLES -A INPUT -p tcp --dport 22 --syn -j LOG --log-prefix "iptables - ssh: "
This how you can read an IpTable log:
|IN=em1||Interface that was used for this incoming packets. This will be empty for outgoing packets|
|OUT=em1||Interface that was used for outgoing packets. This will be empty for incoming packets.|
|MAC=||MAC settings. Example: 00:1c:f0:65:bd:78:00:1d:70:47:f0:b0:08:00
|SRC=||Source IP @ = from where the packet originated|
|DST=||Destination IP @ = where the packets was sent to|
|LEN=||Length of the packet|
|TOS=||TOS field of the IP packet. Unused on most networks, so anything but 0 would be strange.|
|PREC=||Precedence. It's also a routing optimization thing.|
|TTL=||Time to live (hop count of the package)|
|ID||Packet ID number|
|CE | MF||Some packet information.
|WINDOW=||related to the TCP windowing algorithm.|
|< flag(s) >||UDP / TCP flag(s) - if any. Examples: ACK, PSH, FIN|
|URGP=||Urgent flag. TCP may transport 'urgent' (out of band) data|
First, we need to say that IPTABLES will log into a dedicated file.
apt-get install -y rsyslog
Create log file and set rights
touch /var/log/iptables.log chmod 777 /var/log/iptables.log
Create log configuration:
Put the following configuration:
:msg, contains, "iptables - " -/var/log/iptables.log & ~
- 1st line checks the log data for the word “iptables: ” and appends it into the "/var/log/iptables.log" file
- 2nd line simply halts the processing of the log information, so that it doesn't get logged into "/var/log/messages" or "/var/log/syslog" as well as the "/var/log/iptables.log" file.
service rsyslog restart
!! That's all !! :-)
Logs should be appearing in /var/log/iptables.log
You can verify this by tailing the log file:
$ tail -f /var/log/iptables.log
Try and connect to SSH from another machine, and you should see a log entry get created, and appear on the screen automatically.
$ tail -f /var/log/iptables.log Feb 20 23:27:11 ubuntu kernel: [1988916.899165] iptables: IN=eth0 OUT= MAC=00:00:00:00:00:00:00: 00:00:00:00:00:00:00 SRC=192.168.0.3 DST=192.168.0.1 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=60148 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0