Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having strange issue. The problem is, that syslog contains (every 12 seconds) one logged/blocked connection, for example this one belogs to googlebot:

iptables denied: IN=eth0 OUT= SRC=66.249.66.52 DST=<MY_SERVER_IP> LEN=60 TOS=0x00 PREC=0x40 TTL=55 ID=49488 DF PROTO=TCP SPT=47902 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 

or this one to Opera Mini:

iptables denied: IN=eth0 OUT= SRC=141.0.8.219 DST=<MY_SERVER_IP> LEN=60 TOS=0x00 PREC=0x40 TTL=58 ID=41251 DF PROTO=TCP SPT=50426 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 

Iptables rules (removed ssh rules):

# Generated by iptables-save v1.4.12 on Sat Sep 29 14:25:22 2012
*filter
:INPUT DROP [28:2605]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [54305:39093682]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i lo -j ACCEPT
COMMIT
# Completed on Sat Sep 29 14:25:22 2012

Does anyone know what is going on?

share|improve this question
    
Looks like this is the 'googlebot' for what that's worth.crawl-66-249-66-52.googlebot.com. –  Dean Smith Sep 29 '12 at 11:45
    
This time iptables blocks random ip's, for example another one is 141.0.8.219, that belogs to Opera Mini –  Justinas Lelys Sep 29 '12 at 11:47
    
It's not blocking anything, you've just told it to log up to 5 entries/minute for any traffic –  Dean Smith Sep 29 '12 at 12:02
add comment

1 Answer

up vote 2 down vote accepted

It's the third INPUT rule, which is logging samples of all traffic.

It's not actually blocking the traffic at all, the log message just gives you the impression it is.

From the iptables manage

limit

  This  module  matches  at  a  limited  rate  using a token bucket filter.  A rule using this extension will match until this limit is reached

  (unless the ‘!’ flag is used).  It can be used in combination with the LOG target to give limited logging, for example.
share|improve this answer
    
Thank you for your answer. So how can I log all blocked connections? –  Justinas Lelys Sep 29 '12 at 12:04
    
You need a log line and a deny line at the end of the INPUT table. Can't really put that in a comment. My advice would be to download fwbuilder ( a great GUI ) and use that to build you rule base. –  Dean Smith Sep 29 '12 at 13:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.