0

I have a vps guest whose ip is 192.168.1.20. I add the following lines to iptables,

# iptables -A FORWARD -o eth0 -s 192.168.1.20

# iptables -A FORWARD -i eth0 -d 192.168.1.20

Then I run this line to monitor the usage

# iptables -L FORWARD -v -x | grep '192.168.1.20'

But the value of the result is always 0.

3
  • How did you go with this? Jun 25, 2013 at 1:20
  • I'm still figuring it out. I moved the two lines to the top of FORWARD CHAIN. But I still get nothing when monitoring the usage. I tested with wget, yum update commands inside guest os. I guess the packages are filtered through INPUT/OUTPUT chains?
    – Purres
    Jun 27, 2013 at 0:34
  • Would love to know if you got any further with this. Jul 22, 2013 at 12:43

1 Answer 1

1

Without seeing all your rules it's hard to say 100% but it could be that earlier rules in iptables are acting like a catch all, and traffic isn't getting to the forward rules you've shown in your question (this would explain why you're not seeing any data).

As per MadHatter:

Put your two audit rules first, and they should be fine.

Another approach:

Consider using the -j option, which is explained here: http://ipset.netfilter.org/iptables.man.html

-j, --jump target This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this option is omitted in a rule (and -g is not used), then matching the rule will have no effect on the packet's fate, but the counters on the rule will be incremented.

This might serve as a good starting point for you:

http://www.linux.com/learn/tutorials/305767-bandwidth-monitoring-with-iptables

After a rule is matched, the -j option invokes a jump to one of the custom chains.

1
  • The first part of Drew's answer is probably the right one: iptables works on first-dispositive-match wins, which means that chain processing stops for any given packet after a match with a dispositive target (ACCEPT, REJECT, etc.) is found. Put your two audit rules first, and they should be fine. But I disagree strongly with the second part of his answer; rules without targets are an excellent and safe way of accumulating audit data.
    – MadHatter
    Jun 22, 2013 at 5:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .