I use iptables to log all incoming connections. While going through the log in var/log/messages
, I notice that there are some incoming connections from another computer to an unassigned LAN ip address, example:
Jan 7 23:31:28 some kernel: [ 1863.117105] IPTABLES: IN=wlan0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:12:34:56:e1:e1:08:00 SRC=192.168.1.12 DST=192.168.1.255 LEN=239 TOS=0x00 PREC=0x00 TTL=128 ID=37 PROTO=UDP SPT=138 DPT=138 LEN=219
My question is, if these connections are not destined to my server, why are they logged under INPUT? If they are being logged, does it mean that my server is accepting them if I do not filter out these explicitly? My current iptables configuration is:
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j LOG --log-prefix "IPTABLES: " --log-level info
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT
Does it mean that I have to add a -d
to the last rule as in:
-A INPUT -p tcp -d 192.168.1.1 --dport 80 -j ACCEPT
to filter out connections not destined to my server?