3

I have a policy to drop packets in the input chain

        chain input {
                type filter hook input priority 0; policy drop;

How can I log just these dropped packets?

1

Well, I'm going to guess that you also want to know WHAT kind of packet is being logged at the end of your nftables chain.

I would add one line at the end of your chain, example of filter input chain is given below:

table filter {
  ...
  chain input {
    type filter hook input priority 0; policy drop;
    ...
    # All my rules go here

    ...
    # Pick one that suits your needs best
    counter comment "total unfiltered input packets"
    log            # simple detail goes into the log
    log flags all  # extra details go into the log
    log flags all prefix "GOTCHA!: " # parseable keyword
    log flags all counter  # redundant but example
    # drop; # this is redundant policy is drop already
  }
  ...
}
| improve this answer | |
  • These log command log everything not just the dropped/denied packets that the post asked about. – John Eikenberry Jul 25 at 1:20
0

The rules seem to be acted on in order. Policy is drop; then you have whatever accept rules you need. Now simply having

log

on a line by itself at the end does the trick.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.