1

I am trying to set up a sip trunk and so far everything has gone well. The only issue I face is that the call does is not received when the iptables service is running. By stopping the service everything works as expected. What I need is to ideally start the itbales and monitor the packets that are being dropped. Ideally I would not to see the source IP and the port, so that I can track down the issue, can someone please advise what command I would need for this. I have tried a few netstats command and I am still searching but possibly I am searching for the wrong thing.

3
  • Do you mean that you want to log iptables dropped packets to a log file ?
    – krisFR
    Feb 27, 2015 at 14:44
  • @krisFR I just need to see what is being dropped from which ip and on which port. Therefore if i see a line like 1.2.3.4:5080 I know for example that 1.2.3.4 is the SIP provider and therefore I need to open port 5080 for this ip. I am currently looking at logging to a file also. Feb 27, 2015 at 14:49
  • So you should find this interesting : thegeekstuff.com/2012/08/iptables-log-packets
    – krisFR
    Feb 27, 2015 at 14:53

1 Answer 1

4

I used chain which logs everything with limits so it won't spam your syslog

$IPT -N DUMP > /dev/null
$IPT -F DUMP
$IPT -A DUMP -p tcp -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "TCP DUMP: "
$IPT -A DUMP -p udp -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "UDP DUMP: "
$IPT -A DUMP -p tcp -j REJECT --reject-with tcp-reset
$IPT -A DUMP -p udp -j REJECT --reject-with icmp-port-unreachable
$IPT -A DUMP -j DROP

Entire firewall script is located here

1
  • It's like inception, I'll soon be asking a question about a question. Many thanks for the answer and link, now I need to read. Feb 27, 2015 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.