6

Is it possible log all dropped connections by IPTables and set a iptables.log file for logging in /var/log/?

2 Answers 2

9

You can do this my configuring iptables to 'mark' the messages e.g.

iptables -A INPUT -s 192.0.2.0/24 -j LOG --log-prefix='[iptables] '

Which will cause a log message that is prefixed with the text [iptables]

Now you can configure your rsyslog to send these messages to a particular log file by adding a suitable entry to it's configuration e.g.

:msg,contains,"[iptables] " /var/log/iptables.log
1
  • 1
    This will cause messages to go to both syslog and iptables.log. To prevent them from going to syslog, add another line :msg,contains "[iptables] " ~ (that's a tilde). I added these rules to /etc/rsyslog.d/10-iptables.conf. Also, /var/log/iptables.log must exist and be chown'd to syslog:adm.
    – Curt
    Jul 13, 2023 at 2:22
-1

there is a way to log packets in IPTables. first you need to create new chain to logging packets.

iptables -N LOGGING

then you need to append which packets you are gonna log using following commands.

iptables -A INPUT -j LOGGING
iptables -A OUTPUT -j LOGGING

now you can log the packets to the syslogs using this.

iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4

finally this command.

iptables -A LOGGING -j DROP

please add this new lines to bottom of your IPTables files.

3
  • But where will it be logged? Where can I find the log file?
    – user333044
    Jan 29, 2016 at 16:44
  • They are logged in kern.log by default. but you can change this in your syslog server configuration.
    – Dom
    Jan 29, 2016 at 19:24
  • Does not answer the question, which is to log to a separate file. Mar 10 at 11:36

You must log in to answer this question.