I am trying to set up a sip trunk and so far everything has gone well. The only issue I face is that the call does is not received when the iptables service is running. By stopping the service everything works as expected. What I need is to ideally start the itbales and monitor the packets that are being dropped. Ideally I would not to see the source IP and the port, so that I can track down the issue, can someone please advise what command I would need for this. I have tried a few netstats command and I am still searching but possibly I am searching for the wrong thing.
asked Feb 27, 2015 at 14:02
-
Do you mean that you want to log iptables dropped packets to a log file ?– krisFRCommented Feb 27, 2015 at 14:44
-
@krisFR I just need to see what is being dropped from which ip and on which port. Therefore if i see a line like 1.2.3.4:5080 I know for example that 1.2.3.4 is the SIP provider and therefore I need to open port 5080 for this ip. I am currently looking at logging to a file also.– The Humble RatCommented Feb 27, 2015 at 14:49
-
So you should find this interesting : thegeekstuff.com/2012/08/iptables-log-packets– krisFRCommented Feb 27, 2015 at 14:53
Add a comment
|
1 Answer
I used chain which logs everything with limits so it won't spam your syslog
$IPT -N DUMP > /dev/null
$IPT -F DUMP
$IPT -A DUMP -p tcp -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "TCP DUMP: "
$IPT -A DUMP -p udp -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "UDP DUMP: "
$IPT -A DUMP -p tcp -j REJECT --reject-with tcp-reset
$IPT -A DUMP -p udp -j REJECT --reject-with icmp-port-unreachable
$IPT -A DUMP -j DROP
Entire firewall script is located here
-
It's like inception, I'll soon be asking a question about a question. Many thanks for the answer and link, now I need to read. Commented Feb 27, 2015 at 23:01