Firewall log dropped

This explains how to log dropped packets. This is a summary of both excellent articles:

• "The geek stuff" - http://www.thegeekstuff.com/2012/08/iptables-log-packets/
• "Networking howtos" - http://www.networkinghowtos.com/howto/change-the-iptables-log-file/

IpTables logs

Log all dropped packages

Edit your iptables script, add the following part at the end:

IPTABLES=`which iptables`

$IPTABLES -N LOGGING
$IPTABLES -A INPUT -j LOGGING
$IPTABLES -A OUTPUT -j LOGGING
$IPTABLES -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "iptables - dropped: " --log-level 4
$IPTABLES -A LOGGING -j DROP

Log specific events

You can log specific events in an INPUT, OUTPUT or FORWARD chain.

SSH events

IPTABLES=`which iptables`

$IPTABLES -A INPUT -p tcp --dport 22 --syn -j LOG --log-prefix "iptables - ssh: "

Log format

This how you can read an IpTable log:

Field	Explanation
IN=em1	Interface that was used for this incoming packets. This will be empty for outgoing packets
OUT=em1	Interface that was used for outgoing packets. This will be empty for incoming packets.
SRC=	Source IP @ = from where the packet originated
DST=	Destination IP @ = where the packets was sent to
LEN=	Length of the packet
PROTO=	Protocol
SPT=	Source port
DPT=	destination port

Log file

First, we need to say that IPTABLES will log into a dedicated file.

Install rsyslog:

apt-get install -y rsyslog

Create log file and set rights

touch /var/log/iptables.log
chmod 777 /var/log/iptables.log

Create log configuration:

vim /etc/rsyslog.d/10-iptables.conf

Put the following configuration:

:msg, contains, "iptables - " -/var/log/iptables.log
& ~

• 1st line checks the log data for the word “iptables: ” and appends it into the "/var/log/iptables.log" file
• 2nd line simply halts the processing of the log information, so that it doesn't get logged into "/var/log/messages" or "/var/log/syslog" as well as the "/var/log/iptables.log" file.

Restart rsyslog:

service rsyslog restart

!! That's all !! :-)

Logs should be appearing in /var/log/iptables.log

You can verify this by tailing the log file:

$ tail -f /var/log/iptables.log

Try and connect to SSH from another machine, and you should see a log entry get created, and appear on the screen automatically.

Eg:

$ tail -f /var/log/iptables.log Feb 20 23:27:11 ubuntu kernel: [1988916.899165] iptables: IN=eth0 OUT= MAC=00:00:00:00:00:00:00: 00:00:00:00:00:00:00 SRC=192.168.0.3 DST=192.168.0.1 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=60148 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0