View requests that iptables has blocked

Question

Is it possible to view or enable a log that shows what requests iptables is blocking? I am trying to track down a request that iptables is blocking, but shouldn't be (because of an exception rule that I put in place for it).

Answer 1

Generally speaking, this is done by using the -j LOG target before the -j DROP target.

An example, say you have a rule that blocks ssh requests inbound from a particular ip

/sbin/iptables -A INPUT -i eth0 -s xxx.xxx.xxx.xxx -d <external IP on firewall> --dport 22 -j DROP

you would modify your config and add a rule just above this one that looks like this:

/sbin/iptables -A INPUT -i eth0 -s xxx.xxx.xxx.xxx -d <external IP on firewall> --dport 22 -j LOG

you might also want to look at the --log-prefix= option, which will allow you to add some notes (not a lot) to the log.

Answer 2

Yes. You can send the packets to the ULOG target before denying them and configure ulogd to save them in a pcap-formatted file so they can be read with tcpdump or wireshark. See http://www.netfilter.org/projects/ulogd/