Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a box setup as a router using Iptables (masquerade), logging all network traffic.

The problem:

Connections from LAN IPs to WAN show fine, i.e. SRC= -> DST=

but for traffic coming from WAN to LAN it will show the WAN IP as the source, but the routers IP as the destination, then the router -> LAN IP.

I.e. SRC= -> DST= SRC= -> DST=

How do I configure it so that it logs the conversations correctly?

SRC= -> DST= SRC= > DST=

Any help appreciated, cheers

share|improve this question

the info you need is only in the connection tracking table. Have a look at conntrack(8) how to get it. Logging it in real time might be tricky though, maybe something using -j ULOG and ulogd.

share|improve this answer

you can try logging in -t nat -L POSTROUTING before the -j SNAT --to-ip ... line

HTH Oliver

share|improve this answer
I don't have the -j SNAT line. I have the logging configured as: iptables -t nat -A POSTROUTING -j LOG the same for PREROUTING and OUTPUT I also have: iptables -A OUTPUT -j LOG the same for INPUT and FORWARDED Are you saying I should change it to: iptables -t nat -L POSTROUTING -j LOG, dropping the -A switch? Cheers for the reply – Gerard Feb 23 '10 at 2:54
$iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE

where eth0 is the router interface

share|improve this answer

To log all of the information you want, you would need two log rules. One to log the data from the wan interface to router, and a second to log the packet from router to LAN host.

In other words, As the packet passes through your routing tables, the destination will be re-written. If I understand correctly, you want to see that packet's information before it's rewritten, and after (so you can see which host its going to).

The rules may look something like this: Existing rule which shows wan to router:

iptables -I INPUT -m state --state NEW -j LOG --log-prefix " New Incoming Packet"

New Additional Rule:

iptables -I FORWARD -d LAN_HOST_IPADDR -m state --state NEW -j LOG --log-prefix " [>] NEW FORWARD"

Or for extra credit, and to keep things a little cleaner, create a new chain for traffic forwarded to the LAN HOST, something like this:

iptables -t nat -N forward_to_mypc
iptables -t nat -A forward_to_mypc -m state --state NEW -j LOG --log-prefix " [>] New Forward"
iptables -t nat -A forward_to_mypc -j DNAT --to <address_of_mypc>

Then use the new chain like this:

iptables -t nat -I PREROUTING -i <WANADAPTER> -p tcp --dport 3389 -j forward_to_mypc

That would forward any port 3389 tcp packets coming in the wan adapter, to your LAN pc, and if the packet is new, it would get logged.

share|improve this answer
What does forward_to_mypc look like? this is not really clear? – rubo77 Mar 1 at 14:36
The -N parameter creates the forward_to_mypc table and then we append to it with -A. We build it up and then direct packets toward it with the PREROUTING rule that follows. – regulatre Mar 4 at 20:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.