Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a vps guest whose ip is I add the following lines to iptables,

# iptables -A FORWARD -o eth0 -s

# iptables -A FORWARD -i eth0 -d

Then I run this line to monitor the usage

# iptables -L FORWARD -v -x | grep ''

But the value of the result is always 0.

share|improve this question
How did you go with this? – Drew Khoury Jun 25 '13 at 1:20
I'm still figuring it out. I moved the two lines to the top of FORWARD CHAIN. But I still get nothing when monitoring the usage. I tested with wget, yum update commands inside guest os. I guess the packages are filtered through INPUT/OUTPUT chains? – Purres Jun 27 '13 at 0:34
Would love to know if you got any further with this. – Drew Khoury Jul 22 '13 at 12:43

Without seeing all your rules it's hard to say 100% but it could be that earlier rules in iptables are acting like a catch all, and traffic isn't getting to the forward rules you've shown in your question (this would explain why you're not seeing any data).

As per MadHatter:

Put your two audit rules first, and they should be fine.

Another approach:

Consider using the -j option, which is explained here:

-j, --jump target This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this option is omitted in a rule (and -g is not used), then matching the rule will have no effect on the packet's fate, but the counters on the rule will be incremented.

This might serve as a good starting point for you:

After a rule is matched, the -j option invokes a jump to one of the custom chains.

share|improve this answer
The first part of Drew's answer is probably the right one: iptables works on first-dispositive-match wins, which means that chain processing stops for any given packet after a match with a dispositive target (ACCEPT, REJECT, etc.) is found. Put your two audit rules first, and they should be fine. But I disagree strongly with the second part of his answer; rules without targets are an excellent and safe way of accumulating audit data. – MadHatter Jun 22 '13 at 5:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.