I want to log all dropped packets with my iptables (by default all except ssh), but I want to exclude the local network IPs as well as 0.0.0.0, 255.255.255.255 and 192.168.0.255 from appearing in the logs. Excluding only one of them is simple, but excluding all seems to be impossible because they do not belong to the same group of IPs (thus I cannot set a range as in 192.168.0.0/24). I tried by creating multiple log commands, excluding the respective IP in each of them, like this (mind the different names like Iptables-Dropped1 , 2 , 3 and 4 to later distinguish between them in the logs):
-N LOGGING
-A INPUT -j LOGGING
-A LOGGING -i wlp5s0 ! -d 192.168.0.0/25 -m state --state NEW -j LOG --log-prefix "IPTables-Dropped1: " --log-level 4
-A LOGGING -i wlp5s0 ! -d 255.255.255.255 -m state --state NEW -j LOG --log-prefix "IPTables-Dropped2: " --log-level 4
-A LOGGING -i wlp5s0 ! -d 0.0.0.0 -m state --state NEW -j LOG --log-prefix "IPTables-Dropped3: " --log-level 4
-A LOGGING -i wlp5s0 ! -d 192.168.0.255 -m state --state NEW -j LOG --log-prefix "IPTables-Dropped4: " --log-level 4
-A LOGGING -j DROP
But then of course the output looks like this (as one can see, one IP is always blocked correctly but in exchange the others are not:
Aug 8 18:59:35 user kernel: [31773.158959] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.1 DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2
Aug 8 18:59:35 user kernel: [31773.158962] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.1 DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2
Aug 8 18:59:36 user kernel: [31774.079050] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:36 user kernel: [31774.079056] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:36 user kernel: [31774.079060] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:38 user kernel: [31775.922109] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=39031 PROTO=2
Aug 8 18:59:38 user kernel: [31775.922115] IPTables-Dropped2: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=39031 PROTO=2
Aug 8 18:59:38 user kernel: [31775.922118] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=39031 PROTO=2
Aug 8 18:59:38 user kernel: [31775.922122] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=39031 PROTO=2
Aug 8 18:59:39 user kernel: [31777.051946] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:39 user kernel: [31777.051952] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:39 user kernel: [31777.051957] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:40 user kernel: [31777.459943] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=57133 PROTO=UDP SPT=57433 DPT=8612 LEN=24
Aug 8 18:59:40 user kernel: [31777.459950] IPTables-Dropped2: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=57133 PROTO=UDP SPT=57433 DPT=8612 LEN=24
Aug 8 18:59:40 user kernel: [31777.459953] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=57133 PROTO=UDP SPT=57433 DPT=8612 LEN=24
Aug 8 18:59:40 user kernel: [31777.461083] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=38280 PROTO=UDP SPT=53684 DPT=8612 LEN=24
Aug 8 18:59:40 user kernel: [31777.461089] IPTables-Dropped2: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=38280 PROTO=UDP SPT=53684 DPT=8612 LEN=24
Aug 8 18:59:40 user kernel: [31777.461093] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=38280 PROTO=UDP SPT=53684 DPT=8612 LEN=24
Aug 8 18:59:40 user kernel: [31777.461096] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=38280 PROTO=UDP SPT=53684 DPT=8612 LEN=24
Aug 8 18:59:42 user kernel: [31780.025003] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:42 user kernel: [31780.025009] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:42 user kernel: [31780.025013] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:45 user kernel: [31783.100450] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:45 user kernel: [31783.100457] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:45 user kernel: [31783.100461] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288
Aug 8 18:59:47 user kernel: [31784.533540] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=3013 PROTO=UDP SPT=58086 DPT=8612 LEN=24
Aug 8 18:59:47 user kernel: [31784.533546] IPTables-Dropped2: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=3013 PROTO=UDP SPT=58086 DPT=8612 LEN=24
Aug 8 18:59:47 user kernel: [31784.533550] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=3013 PROTO=UDP SPT=58086 DPT=8612 LEN=24
Aug 8 18:59:47 user kernel: [31784.534631] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=18960 PROTO=UDP SPT=65462 DPT=8612 LEN=24
Aug 8 18:59:47 user kernel: [31784.534637] IPTables-Dropped2: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=18960 PROTO=UDP SPT=65462 DPT=8612 LEN=24
Aug 8 18:59:47 user kernel: [31784.534641] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=18960 PROTO=UDP SPT=65462 DPT=8612 LEN=24
Aug 8 18:59:47 user kernel: [31784.534645] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=18960 PROTO=UDP SPT=65462 DPT=8612 LEN=24
As it is not possible in iptables to just e.g. block several IPs separated by comma in one command (which would solve the problem), is there another way to do it?
I am aware that there is netfilter and other, perhaps more professional tools to log (dropped) packets, but I would like to do it with iptables if somehow possible.
Any help but be appreciated.