Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I log what's not being accepted by the following rule:

iptables -A OUTPUT -p icmp --icmp-type 3 -m -limit --limit 10/minute -j ACCEPT

And how do I limit what's being logged because I don't want to log 1000s of pings?

My first thought was:

iptables -A OUTPUT -p icmp --icmp-type 3 -m -limit --limit 50/day -j LOG
iptables -A OUTPUT -p icmp --icmp-type 3 -m -limit --limit 10/minute -j ACCEPT

But that doesn't seem right to me.
I think this limits the logging to 50/day but not necessarily what is not being accepted, or am I wrong?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

To log what isn't being accepted by a rule, you put the log rule after the accept rule (because chain processing stops when it hits an accept rule). To make sure you're logging things that would be accepted by other rules, you need to put the accept rule you're testing (and the log rule) at the very top of the chain.

The log limit you've got in place is reasonable, although I would usually prefer something specified per-minute, and with a higher-than-default limit-burst (which is 3).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.