Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having strange issue. The problem is, that syslog contains (every 12 seconds) one logged/blocked connection, for example this one belogs to googlebot:

iptables denied: IN=eth0 OUT= SRC= DST=<MY_SERVER_IP> LEN=60 TOS=0x00 PREC=0x40 TTL=55 ID=49488 DF PROTO=TCP SPT=47902 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 

or this one to Opera Mini:

iptables denied: IN=eth0 OUT= SRC= DST=<MY_SERVER_IP> LEN=60 TOS=0x00 PREC=0x40 TTL=58 ID=41251 DF PROTO=TCP SPT=50426 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 

Iptables rules (removed ssh rules):

# Generated by iptables-save v1.4.12 on Sat Sep 29 14:25:22 2012
:INPUT DROP [28:2605]
:OUTPUT ACCEPT [54305:39093682]
-A INPUT -i eth0 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i lo -j ACCEPT
# Completed on Sat Sep 29 14:25:22 2012

Does anyone know what is going on?

share|improve this question
Looks like this is the 'googlebot' for what that's – Dean Smith Sep 29 '12 at 11:45
This time iptables blocks random ip's, for example another one is, that belogs to Opera Mini – Justinas Lelys Sep 29 '12 at 11:47
It's not blocking anything, you've just told it to log up to 5 entries/minute for any traffic – Dean Smith Sep 29 '12 at 12:02
up vote 2 down vote accepted

It's the third INPUT rule, which is logging samples of all traffic.

It's not actually blocking the traffic at all, the log message just gives you the impression it is.

From the iptables manage


  This  module  matches  at  a  limited  rate  using a token bucket filter.  A rule using this extension will match until this limit is reached

  (unless the ‘!’ flag is used).  It can be used in combination with the LOG target to give limited logging, for example.
share|improve this answer
Thank you for your answer. So how can I log all blocked connections? – Justinas Lelys Sep 29 '12 at 12:04
You need a log line and a deny line at the end of the INPUT table. Can't really put that in a comment. My advice would be to download fwbuilder ( a great GUI ) and use that to build you rule base. – Dean Smith Sep 29 '12 at 13:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.