iptables logging question

Question

I am wondering what the best approach should be in relation to handling logging of items within iptables. For example, I have a rule such as the following:

$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -m limit --limit 5/min --limit-burst 5 -j LOG --log-prefix "Denied ACK-FIN Scan: " --log-ip-options --log-tcp-sequence --log-tcp-options --log-level 7
$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -j DROP

I was curious if it is better to have the following part of the rule

-m limit --limit 5/min --limit-burst 5 -j LOG --log-prefix "Denied ACK-FIN Scan: " --log-ip-options --log-tcp-sequence --log-tcp-options --log-level 7

included within the chain or if it should be sent to a different chain such as a LOGDROP chain?

Is it possible to have something like the following rules?

$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -m limit --limit 5/min --limit-burst 5 -j LOG --log-prefix "Denied ACK-FIN Scan: "
$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -j LOGDROP

$IPT -A LOGDROP -p TCP --log-ip-options --log-tcp-sequence --log-tcp-options --log-level 7
$IPT -A LOGDROP -j DROP

Thank you in advance for your help with this.

Answer 1

Starting from the bottom...

$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -m limit --limit 5/min --limit-burst 5 -j LOG --log-prefix "Denied ACK-FIN Scan: "
$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -j LOGDROP

$IPT -A LOGDROP -p TCP --log-ip-options --log-tcp-sequence --log-tcp-options --log-level 7
$IPT -A LOGDROP -j DROP

I'm not sure I understand exactly what you're hoping to accomplish here...but as written, no, this won't work. The --log-ip-options and other --log-* options are provided by the LOG module, so without -j LOG they're simply not going to be recognized:

# iptables -A LOGDROP -p tcp --log-iptions
iptables v1.4.7: unknown option `--log-iptions'
Try `iptables -h' or 'iptables --help' for more information.

If that was just a typo and the question is, "can I call LOG multiple times for the same packet?", the answer is yes. You can do this just fine:

-A INPUT -j LOG --log-prefix="prefixA "
-A INPUT -j LOG --log-prefix="prefixB "
-A INPUT -j LOG --log-prefix="prefixC "

And so forth. You'll log the packet multiple times, each with a prefix. As you've shown, it's a good idea to always include the --limit statements to prevent a high rate of matches on these rules from choking your system.

Your question about where best to put a logging rule really depends on your individual needs. If you want to terminate several of your chains with a LOG and DROP combination, it's probably easiest to treat this as a "subroutine" and make a dedicated LOGDROP chain. This does mean that everything will get the same --log-prefix. If you really need to identify specific results, then you're going to have multiple log/drop statements sprinkled throughout your ruleset.