3

I have entered iptables rules to log a specific connection on our server, but it doesn't seem to be working as I want it to. Here are the rules:

1    LOG        tcp  -- !10.51.0.0/16         0.0.0.0/0           state NEW    tcp dpt:8040 LOG flags 0 level 4 prefix `New Connection_8040TCP: '
2    LOG        tcp  -- !192.168.0.0/16       0.0.0.0/0           state NEW tcp dpt:8040 LOG flags 0 level 4 prefix `New Connection_8040TCP: '

Iptables should log only IP connections which are not in the specified networks, but it keeps logging all connections from all IP addresses.

7
  • How are you testing these rules? Are you sure it's not with established connections? Also, can you give us the iptables commands you are using to input the rules? – Belmin Fernandez Apr 17 '15 at 12:18
  • iptables -I INPUT -m state --state NEW ! --src 10.51.0.0/16 -p tcp --dport 8040 -j LOG --log-prefix "New Connection_8040TCP: " – Bryan Apr 17 '15 at 12:19
  • I simply connect with an internal ip to test the rules. thanks – Bryan Apr 17 '15 at 12:19
  • Connexion is a perfectly valid, if slightly old fashioned, alternate spelling of connection, @NathanC. Stack Exchange is not a sausage factory: people are permitted to express things in their preferred phrasing where that does not impede communication. – TRiG Apr 17 '15 at 13:38
  • @TRiG Okay. You can roll it back if you feel that strongly about it. – Nathan C Apr 17 '15 at 13:40
9

The problem is that you can't refer multiple IP ranges in a single iptables rule, but using multiple rules indirectly leads to a disjunction (logical OR): connections will be logged if they match your first, OR your second rule.

What you want, is a conjunctive behavior (logical AND): new connections coming out of 10.51.0.0/16, AND also out of 192.168.0.0/16need to be logged.

This is why you can't find that simple solution which you want. There isn't.

But you can solve this by only a little bit more complex way. You can create a new chain:

iptables -N logger
iptables -A INPUT -j logger
iptables -A logger -s 192.168.0.0/16 -j RETURN
iptables -A logger -s 10.51.0.0/16 -j RETURN
iptables -A logger -j LOG

What these commands do:

  1. they create a new table, named logger.
  2. We set up iptables for every connection to try his table as well.
  3. this logger table checks if your packets originating from your trusted networks (192.168.0.0/16 and 10.51.0.0/16). If yes, all goes normally (the RETURN target gives back the control to the originating table).
  4. If not, the connection is logged (and, as we are on the end of the table, the control also returns to the origin).

As a side effect, you can later use this new table for other tasks as well - for example, to REJECT packets or any other purpose. On my opinion the best if we see iptables as if it were some like a simple programming language.

3
  • Thank you Peterh, that's exactly what i needed. It's working great. – Bryan Apr 17 '15 at 16:13
  • @Bryan Thank you very much! If you are satisfied with an answer, you can (should) accept it by clicking the pipe icon on the left side. It is a big reward to the answering person. (Thanks!) – peterh Apr 17 '15 at 16:25
  • 1
    @Bryan And now you reached the 15 reputation point. From now, you can upvote questions and answers, if you think they deserve it. – peterh Apr 18 '15 at 10:58
6

Incoming connections are always going to match one of those rules aren't they?

A connection from 10.51.0.1 for example won't get logged by the first rule but will hit the second one.

Don't you need the equivalent of !10.51.0.0/16 && !192.168.0.0/16 (probably not valid syntax but correct logically).

4
  • To my mind, you've hit the nail on the head. +1 from me. – MadHatter Apr 17 '15 at 13:36
  • Just accept the connections for the networks, and then log in a third rule. – wurtel Apr 17 '15 at 14:23
  • @wurtel ACCEPT-ing can cause harmful interference, for example if he has later some DROP rules. – peterh Apr 17 '15 at 14:34
  • Paul Haldane, you were right, and peterh give the tricks. Thanks for your contribution – Bryan Apr 17 '15 at 16:45
0

Depending on version and distribution, sometimes you have to activate the iprange extension:

iptables -A INPUT -s ! 10.51.0.0/16 -m iprange -j LOG

2
  • It will log the 192.168.0.0/16 connections too, which contradicts the wish of the OP. Anyways isn't clear why you need the iprange module for this simple rule. – peterh Apr 17 '15 at 14:32
  • This was just an example, of course you have to add the second range, too. On some older distribution you have to activate the iprange module as it is not active by default. – Sebastian Apr 20 '15 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.