Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In short, I am actually looking for the log files to see any incoming connection being blocked in debian lenny server.

Or any other way to know? I am using iptables

share|improve this question

2 Answers 2

You would have to add a rule at the end of your chains to send the packet to the LOG target before letting it run into the default DENY policy.

share|improve this answer

By default, dropped packets aren't logged. This can be a huge amount of traffic if you enable it, and syslog by default will write messages to the disc in the most "safe" mode, which causes heavy disc I/O loading. So be careful that this doesn't end up flooding your server.

To enable logging of dropped or rejected packets, I would recommend adding a LOG rule before the DROP/REJECT rule, something like this:

-A FORWARD -m limit --limit 4/sec --limit-burst 20 -j LOG --log-prefix "Dropping  (FORWARD): " 
-A FORWARD -j DROP 

This uses the "limit" module to allow up to 20 packets to be logged before it starts limiting them to no more than 4 per second. It'll allow 20 more packets once the 4/second limit hasn't been hit for a while.

There's also the "hashlimit" module which may be available on your system that allows you to have a unique limit per remote or local IP address. See "man iptables" for more information on hashlimit.

Finally, you probably want to write your log messages to a destination where you have disabled fsync. On older systems this was done by putting a "-" at the beginning of the file name in /etc/syslog.conf. I'm not seeing a similar option for rsyslog, so just be aware of it and if you see disc I/O go through the roof when you log a lot of packets, you may need to add stronger limits or look into changing rsyslog's configuration.

share|improve this answer
    
Where it supposed to log to? Is it supposed to go \var\log\syslog? Pardon if this is newbie question. –  henry Dec 1 '10 at 9:11
    
By default, it would log to /var/log/syslog I believe. –  Sean Reifschneider Dec 1 '10 at 10:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.