I am trying to set up a sip trunk and so far everything has gone well. The only issue I face is that the call does is not received when the iptables service is running. By stopping the service everything works as expected. What I need is to ideally start the itbales and monitor the packets that are being dropped. Ideally I would not to see the source IP and the port, so that I can track down the issue, can someone please advise what command I would need for this. I have tried a few netstats command and I am still searching but possibly I am searching for the wrong thing.
Do you mean that you want to log iptables dropped packets to a log file ?– krisFRFeb 27, 2015 at 14:44
@krisFR I just need to see what is being dropped from which ip and on which port. Therefore if i see a line like 188.8.131.52:5080 I know for example that 184.108.40.206 is the SIP provider and therefore I need to open port 5080 for this ip. I am currently looking at logging to a file also.– The Humble RatFeb 27, 2015 at 14:49
So you should find this interesting : thegeekstuff.com/2012/08/iptables-log-packets– krisFRFeb 27, 2015 at 14:53
I used chain which logs everything with limits so it won't spam your syslog
$IPT -N DUMP > /dev/null $IPT -F DUMP $IPT -A DUMP -p tcp -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "TCP DUMP: " $IPT -A DUMP -p udp -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "UDP DUMP: " $IPT -A DUMP -p tcp -j REJECT --reject-with tcp-reset $IPT -A DUMP -p udp -j REJECT --reject-with icmp-port-unreachable $IPT -A DUMP -j DROP
Entire firewall script is located here
It's like inception, I'll soon be asking a question about a question. Many thanks for the answer and link, now I need to read. Feb 27, 2015 at 23:01