Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to view or enable a log that shows what requests iptables is blocking? I am trying to track down a request that iptables is blocking, but shouldn't be (because of an exception rule that I put in place for it).

share|improve this question
1  
You might find this helpful. serverfault.com/a/126079/984 –  Zoredache Jan 23 '12 at 18:28

2 Answers 2

up vote 4 down vote accepted

Generally speaking, this is done by using the -j LOG target before the -j DROP target.

An example, say you have a rule that blocks ssh requests inbound from a particular ip

/sbin/iptables -A INPUT -i eth0 -s xxx.xxx.xxx.xxx -d <external IP on firewall> --dport 22 -j DROP

you would modify your config and add a rule just above this one that looks like this:

/sbin/iptables -A INPUT -i eth0 -s xxx.xxx.xxx.xxx -d <external IP on firewall> --dport 22 -j LOG

you might also want to look at the --log-prefix= option, which will allow you to add some notes (not a lot) to the log.

share|improve this answer
    
Perfect. This doesn't tell me why my rule isn't allowing the exception but it is showing the incoming connection in the messages log. –  Resorath Jan 23 '12 at 20:28

Yes. You can send the packets to the ULOG target before denying them and configure ulogd to save them in a pcap-formatted file so they can be read with tcpdump or wireshark. See http://www.netfilter.org/projects/ulogd/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.