Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I setup iptables in a way I know what packet is blocked by which rule? The one solution I know of is to -j LOG --log-prefix. Is there any other way?

share|improve this question
up vote 1 down vote accepted

You can look at packet/byte counters:

Chain FIREWALL (2 references)
pkts bytes target prot opt in out source destination

73M 42G ACCEPT all -- lo *

You can clear the counters with the '-Z' option. You can direct types of packets to their own table and accept them individually based on the source if you want to track the source.

iptables -N SMTP
iptables -I INPUT -p tcp --dport 25 -j SMTP
iptables -A SMTP -s $network_1 -j ACCEPT
iptables -A SMTP -s $network_2 -j ACCEPT
iptables -A SMTP -j RETURN

#Track by network instead of application
iptables -N NETWORK_1 
iptables -I INPUT -s $network_1 -j NETWORK_1
iptables -A NETWORK_1 -p tcp --dport 25 -j ACCEPT -m comment --comment "MAIL"
iptables -A NETWORK_1 -p udp --dport 10000:20000 -j ACCEPT -m comment --comment "VOIP RTP"
iptables -A NETwORK_1 -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A NETWORK_1 -p tcp -j ACCEPT -m comment --comment "UNKNOWN TCP"
iptables -A NETWORK_1 -j RETURN -m comment --comment "This rule is not required but used for ip accounting"
share|improve this answer
Don't forget the command to peek at those counters: iptables -L -v -n. – Tobu Dec 21 '09 at 14:13

There is also -j ULOG, that you can use together with ulogd.

share|improve this answer

Look into the TRACE target

This target marks packets so that the kernel will log every rule which match the packets as those tra-verse the tables, chains, rules. (The ipt_LOG or ip6t_LOG module is required for the logging.) The packets are logged with the string prefix: "TRACE: tablename:chainname:type:rulenum " where type can be "rule" for plain rule, "return" for implicit rule at the end of a user defined chain and "policy" for the policy of the built in chains. It can only be used in the raw table.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.