In short, I am actually looking for the log files to see any incoming connection being blocked in debian lenny server.
Or any other way to know? I am using iptables
You would have to add a rule at the end of your chains to send the packet to the
By default, dropped packets aren't logged. This can be a huge amount of traffic if you enable it, and syslog by default will write messages to the disc in the most "safe" mode, which causes heavy disc I/O loading. So be careful that this doesn't end up flooding your server.
To enable logging of dropped or rejected packets, I would recommend adding a LOG rule before the DROP/REJECT rule, something like this:
This uses the "limit" module to allow up to 20 packets to be logged before it starts limiting them to no more than 4 per second. It'll allow 20 more packets once the 4/second limit hasn't been hit for a while.
There's also the "hashlimit" module which may be available on your system that allows you to have a unique limit per remote or local IP address. See "man iptables" for more information on hashlimit.
Finally, you probably want to write your log messages to a destination where you have disabled fsync. On older systems this was done by putting a "-" at the beginning of the file name in /etc/syslog.conf. I'm not seeing a similar option for rsyslog, so just be aware of it and if you see disc I/O go through the roof when you log a lot of packets, you may need to add stronger limits or look into changing rsyslog's configuration.