1

I rerouted all internet traffic from my old Debian 7 server to my new server with

DEST_IP=123.123.123.123
for p in 25 110 143 587 993 995 80 443; do
  iptables -t nat -A PREROUTING -i eth0 -p tcp --dport $p -j DNAT --to $DEST_IP:$p
  iptables -t nat -A POSTROUTING -p tcp -d $DEST_IP --dport $p -j MASQUERADE
done

Since I want to turn off my old server soon, I want to know which domains still use my old server. How do I log all forwarded packages to detect services that are still using the old server?

I tried

iptables -t nat -A PREROUTING -j LOG --log-prefix "PREROUTING:" --log-level 6
iptables -t nat -A POSTROUTING -j LOG --log-prefix "MASQUERADE:" --log-level 6

but that only creates some lines in /var/log/kern.log and /var/log/syslog that don't contain the right information. I only get these:

Mar  1 16:08:12 eclabs kernel: [788769.999678] PREROUTING:IN=eth0 OUT= MAC=00:e0:4c:5d:d5:66:44:f4:77:0f:ea:f4:08:00 SRC=213.133.113.83 DST=123.123.123.123 LEN=84 TOS=0x00 PREC=0x00 TTL=59 ID=11348 DF PROTO=ICMP TYPE=8 CODE=0 ID=20760 SEQ=1 

Where 213.133.113.83 is unkknown to me (seems to be my provider)

1

1 Answer 1

0

try to add -j LOG --log-prefix "iptables log:"

before your routing rules or at the head of the nat table, your exact setup might vary.

2
  • I don't get the correct lines logged. Have I done something wrong? (i edited my question)
    – rubo77
    Mar 1, 2016 at 15:08
  • 1
    you might want to give us an example, however based on the edited question you seem to want to know which domains still use your old server, so you can edit those in your DNS. That is not something you usually do with iptables, but instead via proxy as posted in the other comment. Mar 1, 2016 at 15:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .