Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I added logging rules to all of netfilter's built-in chains using the following script:

All logging rules get the correct --log-prefix argument (verified by using "iptables -t table -L -n -v" and "iptables -t table -S" commands). For example, here's the output for the nat table:

-A PREROUTING -d IP/32 -j LOG --log-prefix "[nat/PREROUTING] "
-A PREROUTING -s IP/32 -j LOG --log-prefix "[nat/PREROUTING] "
-A INPUT -d IP/32 -j LOG --log-prefix "[nat/INPUT] "
-A INPUT -s IP/32 -j LOG --log-prefix "[nat/INPUT] "
-A OUTPUT -d IP/32 -j LOG --log-prefix "[nat/OUTPUT] "
-A OUTPUT -s IP/32 -j LOG --log-prefix "[nat/OUTPUT] "
-A POSTROUTING -d IP/32 -j LOG --log-prefix "[nat/POSTROUTING] "
-A POSTROUTING -s IP/32 -j LOG --log-prefix "[nat/POSTROUTING] "

Additional info:

#iptables --version
iptables v1.4.14
#uname -a
Linux debian 3.2.0-4-amd64 #1 SMP Debian 3.2.41-2 x86_64 GNU/Linux

Why do I still get some log messages in syslog that don't have a log prefix at all?

share|improve this question
May be if you attach the "iptable -S" ouput's ... – Brigo Apr 7 '13 at 23:23
Added output of "iptables -t nat -S" as suggested by Brigo. – Yonatan Broza Apr 18 '13 at 13:22
I think this rules are loggin only from one ip IP/32. Can you paste the syslog output, please? – Brigo Apr 18 '13 at 14:20
That's right - I'm only interested in traffic to/from one IP address. I'll include syslog output as soon as I can. – Yonatan Broza Apr 30 '13 at 15:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.