I'd like to invoke sending an e-mail (or running a particular script, if that would be possible) when a certain iptables DROP rule is being run. (For instance, when I'm blocking an IP after 5 failed SSH logins, I'd like to run
mail -s "SSH Blocked" email@example.com or something similar. Is there a way to directly have iptables execute this?
If not, then I guess I'd need to scan the logs with an external tool and then send out emails. Any recommended tool for this? Please note that I'm using
systemd so I am using
journalctl and not old fashioned log files.