I rerouted all internet traffic from my old Debian 7 server to my new server with
DEST_IP=123.123.123.123
for p in 25 110 143 587 993 995 80 443; do
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport $p -j DNAT --to $DEST_IP:$p
iptables -t nat -A POSTROUTING -p tcp -d $DEST_IP --dport $p -j MASQUERADE
done
Since I want to turn off my old server soon, I want to know which domains still use my old server. How do I log all forwarded packages to detect services that are still using the old server?
I tried
iptables -t nat -A PREROUTING -j LOG --log-prefix "PREROUTING:" --log-level 6
iptables -t nat -A POSTROUTING -j LOG --log-prefix "MASQUERADE:" --log-level 6
but that only creates some lines in /var/log/kern.log and /var/log/syslog that don't contain the right information. I only get these:
Mar 1 16:08:12 eclabs kernel: [788769.999678] PREROUTING:IN=eth0 OUT= MAC=00:e0:4c:5d:d5:66:44:f4:77:0f:ea:f4:08:00 SRC=213.133.113.83 DST=123.123.123.123 LEN=84 TOS=0x00 PREC=0x00 TTL=59 ID=11348 DF PROTO=ICMP TYPE=8 CODE=0 ID=20760 SEQ=1
Where 213.133.113.83 is unkknown to me (seems to be my provider)