Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I added logging rules to all of netfilter's built-in chains using the following script:

https://gist.github.com/anonymous/5330491

All logging rules get the correct --log-prefix argument (verified by using "iptables -t table -L -n -v" and "iptables -t table -S" commands). For example, here's the output for the nat table:

-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A PREROUTING -d IP/32 -j LOG --log-prefix "[nat/PREROUTING] "
-A PREROUTING -s IP/32 -j LOG --log-prefix "[nat/PREROUTING] "
-A INPUT -d IP/32 -j LOG --log-prefix "[nat/INPUT] "
-A INPUT -s IP/32 -j LOG --log-prefix "[nat/INPUT] "
-A OUTPUT -d IP/32 -j LOG --log-prefix "[nat/OUTPUT] "
-A OUTPUT -s IP/32 -j LOG --log-prefix "[nat/OUTPUT] "
-A POSTROUTING -d IP/32 -j LOG --log-prefix "[nat/POSTROUTING] "
-A POSTROUTING -s IP/32 -j LOG --log-prefix "[nat/POSTROUTING] "

Additional info:

#iptables --version
iptables v1.4.14
#uname -a
Linux debian 3.2.0-4-amd64 #1 SMP Debian 3.2.41-2 x86_64 GNU/Linux

Why do I still get some log messages in syslog that don't have a log prefix at all?

share|improve this question
    
May be if you attach the "iptable -S" ouput's ... –  Brigo Apr 7 '13 at 23:23
    
Added output of "iptables -t nat -S" as suggested by Brigo. –  Yonatan Broza Apr 18 '13 at 13:22
    
I think this rules are loggin only from one ip IP/32. Can you paste the syslog output, please? –  Brigo Apr 18 '13 at 14:20
    
That's right - I'm only interested in traffic to/from one IP address. I'll include syslog output as soon as I can. –  Yonatan Broza Apr 30 '13 at 15:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.