7

I have followed the example for iptable logging from https://help.ubuntu.com/community/IptablesHowTo#More_detailed_Logging

sudo iptables -I INPUT 5 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

I get log entries like below

Oct 20 03:45:50 hostname kernel: iptables denied: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=x.x.x.x DST=x.x.x.x LEN=1059 TOS=0x00 PREC=0x00 TTL=115 ID=31368 DF PROTO=TCP SPT=17992 DPT=80 WINDOW=16477 RES=0x00 ACK PSH URGP=0 
Oct 20 03:46:02 hostname kernel: iptables denied: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=x.x.x.x DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=763 DF PROTO=TCP SPT=20229 DPT=22 WINDOW=15588 RES=0x00 ACK URGP=0 
Oct 20 03:46:14 hostname kernel: iptables denied: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=x.x.x.x DST=x.x.x.x LEN=324 TOS=0x00 PREC=0x00 TTL=49 ID=64245 PROTO=TCP SPT=47237 DPT=80 WINDOW=470 RES=0x00 ACK PSH URGP=0 
Oct 20 03:46:26 hostname kernel: iptables denied: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=x.x.x.x DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=45 ID=2010 PROTO=TCP SPT=48322 DPT=80 WINDOW=380 RES=0x00 ACK URGP=0 

Similar log above appears every 2 - 3 seconds seems like there is a lot of traffic being blocked. But my question is how do I determine what sort of traffic is being blocked or dropped base on the log entries above?

Is DPT means destination port? so DPT=22 means SSH access is blocked? and DPT=80 means HTTP traffic is blocked?

My iptables are mainly default values, except I have added a few additional rules

-A INPUT -s z.z.z.z/32 -j DROP
-A INPUT -s y.y.y.y/32 -j DROP
-A INPUT -s a.a.a.a/32 -j DROP
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

None of the SRC ip in the log files are from the iptables that is specifically configured to drop all traffic, and yet the log files showing different ip address with DPT=80, DPT=22 being dropped.

Is there something wrong with my config?

  • Yes, something is most likely wrong with your configuration. What are you trying to do exactly? Yes, port 22 is SSH and 80 is HTTP and DPT is destination port, so you are logging some HTTP and SSH traffic. What is your goal? Are you trying to log traffic without affecting it? Are you trying to reject traffic? The "limit" module is used to match in a rate limited fashion. – Eddie Oct 20 '14 at 3:09
  • Hi Eddie, I am just trying to block all traffic from certain IP, hence the additional rules like -A INPUT -s z.z.z.z/32 -j DROP -A INPUT -s y.y.y.y/32 -j DROP -A INPUT -s a.a.a.a/32 -j DROP – forestclown Oct 20 '14 at 3:13
  • 1
    This rule -m limit --limit 5/min -j LOG --log-prefix "iptables denied: will log all packets matching it but no more than five per minute. It doesn't actually deny them, despite what the log prefix is set to. Do you want to log and block all traffic from a certain IP? – Eddie Oct 20 '14 at 3:15
  • If the IP I am blocking in iptables are actually proxy servers, will that explain why different SRC address is logged? – forestclown Oct 20 '14 at 3:15
  • I just want to log traffic that is blocked by iptables. – forestclown Oct 20 '14 at 3:17
25

Here are your rules again:

-A INPUT -s z.z.z.z/32 -j DROP
-A INPUT -s y.y.y.y/32 -j DROP
-A INPUT -s a.a.a.a/32 -j DROP
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

The first will will silently drop any packet matching it. As will the second and third. By the time you hit the "limit" rule, you have already dropped all packets matching those source IP addresses. You now have the rest of the traffic. For this rest of the traffic, you will log five packets per minute. You will misleadingly log them as denied when they are not actually denied.

If, instead, you want to log and drop packets matching any one of several source IP addresses, the easiest way to do this is to create a new chain that will log and drop. e.g.:

iptables -N LOG_AND_DROP
iptables -A LOG_AND_DROP -j LOG --log-prefix "Source host denied "
iptables -A LOG_AND_DROP -j DROP

Now that you have this chain, you want to direct traffic to log and drop to it:

iptables -A INPUT -s z.z.z.z/32 -j LOG_AND_DROP
iptables -A INPUT -s y.y.y.y/32 -j LOG_AND_DROP
iptables -A INPUT -s a.a.a.a/32 -j LOG_AND_DROP

This will take any packet matching those source addresses and send it to the LOG_AND_DROP chain. This chain, as it is named, first logs every single packet and then drops it. If you prefer, you can rate limit the logging and then drop it. Up to you, and depends on how much traffic we're talking about.

Note: Make sure you flush existing rules before adding the above rules. Otherwise you'll still have the misleading rule in there that is logging but not denying.

| improve this answer | |
  • Will this also account for ipv6? or there will be a separate rules needed for ipv6? – forestclown Oct 20 '14 at 5:16
  • 3
    For ipv6 you need to use ip6tables. It's separate. – Eddie Oct 20 '14 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.