3

I have entered iptables rules to log a specific connection on our server, but it doesn't seem to be working as I want it to. Here are the rules:

1    LOG        tcp  -- !10.51.0.0/16         0.0.0.0/0           state NEW    tcp dpt:8040 LOG flags 0 level 4 prefix `New Connection_8040TCP: '
2    LOG        tcp  -- !192.168.0.0/16       0.0.0.0/0           state NEW tcp dpt:8040 LOG flags 0 level 4 prefix `New Connection_8040TCP: '

Iptables should log only IP connections which are not in the specified networks, but it keeps logging all connections from all IP addresses.

7
  • How are you testing these rules? Are you sure it's not with established connections? Also, can you give us the iptables commands you are using to input the rules? Apr 17, 2015 at 12:18
  • iptables -I INPUT -m state --state NEW ! --src 10.51.0.0/16 -p tcp --dport 8040 -j LOG --log-prefix "New Connection_8040TCP: "
    – Bryan
    Apr 17, 2015 at 12:19
  • I simply connect with an internal ip to test the rules. thanks
    – Bryan
    Apr 17, 2015 at 12:19
  • Connexion is a perfectly valid, if slightly old fashioned, alternate spelling of connection, @NathanC. Stack Exchange is not a sausage factory: people are permitted to express things in their preferred phrasing where that does not impede communication.
    – TRiG
    Apr 17, 2015 at 13:38
  • @TRiG Okay. You can roll it back if you feel that strongly about it.
    – Nathan C
    Apr 17, 2015 at 13:40

3 Answers 3

9

The problem is that you can't refer multiple IP ranges in a single iptables rule, but using multiple rules indirectly leads to a disjunction (logical OR): connections will be logged if they match your first, OR your second rule.

What you want, is a conjunctive behavior (logical AND): new connections coming out of 10.51.0.0/16, AND also out of 192.168.0.0/16need to be logged.

This is why you can't find that simple solution which you want. There isn't.

But you can solve this by only a little bit more complex way. You can create a new chain:

iptables -N logger
iptables -A INPUT -j logger
iptables -A logger -s 192.168.0.0/16 -j RETURN
iptables -A logger -s 10.51.0.0/16 -j RETURN
iptables -A logger -j LOG

What these commands do:

  1. they create a new table, named logger.
  2. We set up iptables for every connection to try his table as well.
  3. this logger table checks if your packets originating from your trusted networks (192.168.0.0/16 and 10.51.0.0/16). If yes, all goes normally (the RETURN target gives back the control to the originating table).
  4. If not, the connection is logged (and, as we are on the end of the table, the control also returns to the origin).

As a side effect, you can later use this new table for other tasks as well - for example, to REJECT packets or any other purpose. On my opinion the best if we see iptables as if it were some like a simple programming language.

3
  • Thank you Peterh, that's exactly what i needed. It's working great.
    – Bryan
    Apr 17, 2015 at 16:13
  • @Bryan Thank you very much! If you are satisfied with an answer, you can (should) accept it by clicking the pipe icon on the left side. It is a big reward to the answering person. (Thanks!)
    – peterh
    Apr 17, 2015 at 16:25
  • 1
    @Bryan And now you reached the 15 reputation point. From now, you can upvote questions and answers, if you think they deserve it.
    – peterh
    Apr 18, 2015 at 10:58
6

Incoming connections are always going to match one of those rules aren't they?

A connection from 10.51.0.1 for example won't get logged by the first rule but will hit the second one.

Don't you need the equivalent of !10.51.0.0/16 && !192.168.0.0/16 (probably not valid syntax but correct logically).

4
  • To my mind, you've hit the nail on the head. +1 from me.
    – MadHatter
    Apr 17, 2015 at 13:36
  • Just accept the connections for the networks, and then log in a third rule.
    – wurtel
    Apr 17, 2015 at 14:23
  • @wurtel ACCEPT-ing can cause harmful interference, for example if he has later some DROP rules.
    – peterh
    Apr 17, 2015 at 14:34
  • Paul Haldane, you were right, and peterh give the tricks. Thanks for your contribution
    – Bryan
    Apr 17, 2015 at 16:45
0

Depending on version and distribution, sometimes you have to activate the iprange extension:

iptables -A INPUT -s ! 10.51.0.0/16 -m iprange -j LOG

2
  • It will log the 192.168.0.0/16 connections too, which contradicts the wish of the OP. Anyways isn't clear why you need the iprange module for this simple rule.
    – peterh
    Apr 17, 2015 at 14:32
  • This was just an example, of course you have to add the second range, too. On some older distribution you have to activate the iprange module as it is not active by default.
    – Sebastian
    Apr 20, 2015 at 7:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .