Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am wondering what the best approach should be in relation to handling logging of items within iptables. For example, I have a rule such as the following:

$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -m limit --limit 5/min --limit-burst 5 -j LOG --log-prefix "Denied ACK-FIN Scan: " --log-ip-options --log-tcp-sequence --log-tcp-options --log-level 7
$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -j DROP

I was curious if it is better to have the following part of the rule

-m limit --limit 5/min --limit-burst 5 -j LOG --log-prefix "Denied ACK-FIN Scan: " --log-ip-options --log-tcp-sequence --log-tcp-options --log-level 7

included within the chain or if it should be sent to a different chain such as a LOGDROP chain?

Is it possible to have something like the following rules?

$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -m limit --limit 5/min --limit-burst 5 -j LOG --log-prefix "Denied ACK-FIN Scan: "
$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -j LOGDROP

$IPT -A LOGDROP -p TCP --log-ip-options --log-tcp-sequence --log-tcp-options --log-level 7
$IPT -A LOGDROP -j DROP

Thank you in advance for your help with this.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Starting from the bottom...

$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -m limit --limit 5/min --limit-burst 5 -j LOG --log-prefix "Denied ACK-FIN Scan: "
$IPT -A BADTCP -p tcp -m tcp --tcp-flags ACK,FIN FIN -j LOGDROP

$IPT -A LOGDROP -p TCP --log-ip-options --log-tcp-sequence --log-tcp-options --log-level 7
$IPT -A LOGDROP -j DROP

I'm not sure I understand exactly what you're hoping to accomplish here...but as written, no, this won't work. The --log-ip-options and other --log-* options are provided by the LOG module, so without -j LOG they're simply not going to be recognized:

# iptables -A LOGDROP -p tcp --log-iptions
iptables v1.4.7: unknown option `--log-iptions'
Try `iptables -h' or 'iptables --help' for more information.

If that was just a typo and the question is, "can I call LOG multiple times for the same packet?", the answer is yes. You can do this just fine:

-A INPUT -j LOG --log-prefix="prefixA "
-A INPUT -j LOG --log-prefix="prefixB "
-A INPUT -j LOG --log-prefix="prefixC "

And so forth. You'll log the packet multiple times, each with a prefix. As you've shown, it's a good idea to always include the --limit statements to prevent a high rate of matches on these rules from choking your system.

Your question about where best to put a logging rule really depends on your individual needs. If you want to terminate several of your chains with a LOG and DROP combination, it's probably easiest to treat this as a "subroutine" and make a dedicated LOGDROP chain. This does mean that everything will get the same --log-prefix. If you really need to identify specific results, then you're going to have multiple log/drop statements sprinkled throughout your ruleset.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.