I want to log all INPUT packets that do not originate in the LAN for audit purposes, I have a script with tcpdump basically appending to a file the result from this:
tcpdump "(dst net 192.168.0.0/24 and ! src net 192.168.0.0/24)"
however, I've seen some outside attempts in /var/log/syslog
[567325.985994] iptables INPUT denied: IN=eth1 OUT= MAC=..... SRC=220.127.116.11 DST=192.168.0.2 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=50281 DF PROTO=TCP SPT=51380 DPT=1194 WINDOW=5840 RES=0x00 SYN URGP=0 [567895.076532] iptables INPUT denied: IN=eth1 OUT= MAC=.... SRC=18.104.22.168 DST=192.168.0.2 LEN=40 TOS=0x00 PREC=0x00 TTL=59 ID=0 DF PROTO=TCP SPT=80 DPT=52589 WINDOW=0 RES=0x00 RST URGP=0
which don't show up in tcpdump outout. I want to add a rule like
-A INPUT -j LOG
but I would like (if it makes sense) to avoid putting in the log input packets from the LAN
is it enough to put this?
-A INPUT ! -s 192.168.0.0/24 -j LOG
BTW, as an a side question, does iptables support logging different things to different files?