Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a box setup as a router using Iptables (masquerade), logging all network traffic.

The problem:

Connections from LAN IPs to WAN show fine, i.e. SRC=192.168.32.10 -> DST=60.242.67.190

but for traffic coming from WAN to LAN it will show the WAN IP as the source, but the routers IP as the destination, then the router -> LAN IP.

I.e. SRC=60.242.67.190 -> DST=192.168.32.199 SRC=192.168.32.199(router) -> DST=192.168.32.10

How do I configure it so that it logs the conversations correctly?

SRC=192.168.32.10 -> DST=60.242.67.190 SRC=60.242.67.190 > DST=192.168.32.10

Any help appreciated, cheers

share|improve this question
add comment

4 Answers

the info you need is only in the connection tracking table. Have a look at conntrack(8) how to get it. Logging it in real time might be tricky though, maybe something using -j ULOG and ulogd.

share|improve this answer
add comment

you can try logging in -t nat -L POSTROUTING before the -j SNAT --to-ip ... line

HTH Oliver

share|improve this answer
    
I don't have the -j SNAT line. I have the logging configured as: iptables -t nat -A POSTROUTING -j LOG the same for PREROUTING and OUTPUT I also have: iptables -A OUTPUT -j LOG the same for INPUT and FORWARDED Are you saying I should change it to: iptables -t nat -L POSTROUTING -j LOG, dropping the -A switch? Cheers for the reply –  Gerard Feb 23 '10 at 2:54
add comment

To log all of the information you want, you would need two log rules. One to log the data from wan to router, and a second to log the packet from router to LAN host.

In other words, As the packet passes through your routing tables, the destination will be re-written. If I understand correctly, you want to see that packet's information before it's rewritten, and after (so you can see which host its going to).

The rules may look something like this: Existing rule which shows wan to router:

iptables -I INPUT -m state --state NEW -j LOG --log-prefix " New Incoming Packet"

New Additional Rule:

iptables -I FORWARD -d LAN_HOST_IPADDR -m state --state NEW -j LOG --log-prefix " [>] NEW FORWARD"

Or for extra credit, and to keep things a little cleaner, create a new chain for traffic forwarded to the LAN HOST, something like this:

iptables -t nat -N forward_to_mypc
iptables -t nat -A forward_to_mypc -m state --state NEW -j LOG --log-prefix " [>] New Forward"
iptables -t nat -A forward_to_mypc -j DNAT --to <address_of_mypc>

Then use the new chain like this:

iptables -t nat -i PREROUTING -i <WANADAPTER> -p tcp --dport 3389 -j forward_to_mypc

That would forward any port 3389 tcp packets coming in the wan adapter, to your LAN pc, and if the packet is new, it would get logged.

share|improve this answer
add comment
$iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE

where eth0 is the router interface

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.