-1

I want to log all dropped packets with my iptables (by default all except ssh), but I want to exclude the local network IPs as well as 0.0.0.0, 255.255.255.255 and 192.168.0.255 from appearing in the logs. Excluding only one of them is simple, but excluding all seems to be impossible because they do not belong to the same group of IPs (thus I cannot set a range as in 192.168.0.0/24). I tried by creating multiple log commands, excluding the respective IP in each of them, like this (mind the different names like Iptables-Dropped1 , 2 , 3 and 4 to later distinguish between them in the logs):

-N LOGGING

-A INPUT -j LOGGING

-A LOGGING -i wlp5s0 ! -d 192.168.0.0/25 -m state --state NEW -j LOG --log-prefix "IPTables-Dropped1: " --log-level 4

-A LOGGING -i wlp5s0 ! -d 255.255.255.255 -m state --state NEW -j LOG --log-prefix "IPTables-Dropped2: " --log-level 4

-A LOGGING -i wlp5s0 ! -d 0.0.0.0 -m state --state NEW -j LOG --log-prefix "IPTables-Dropped3: " --log-level 4

-A LOGGING -i wlp5s0 ! -d 192.168.0.255 -m state --state NEW -j LOG --log-prefix "IPTables-Dropped4: " --log-level 4

-A LOGGING -j DROP

But then of course the output looks like this (as one can see, one IP is always blocked correctly but in exchange the others are not:

Aug 8 18:59:35 user kernel: [31773.158959] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.1 DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2

Aug 8 18:59:35 user kernel: [31773.158962] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.1 DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2

Aug 8 18:59:36 user kernel: [31774.079050] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:36 user kernel: [31774.079056] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:36 user kernel: [31774.079060] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:38 user kernel: [31775.922109] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=39031 PROTO=2

Aug 8 18:59:38 user kernel: [31775.922115] IPTables-Dropped2: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=39031 PROTO=2

Aug 8 18:59:38 user kernel: [31775.922118] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=39031 PROTO=2

Aug 8 18:59:38 user kernel: [31775.922122] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=39031 PROTO=2

Aug 8 18:59:39 user kernel: [31777.051946] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:39 user kernel: [31777.051952] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:39 user kernel: [31777.051957] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:40 user kernel: [31777.459943] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=57133 PROTO=UDP SPT=57433 DPT=8612 LEN=24

Aug 8 18:59:40 user kernel: [31777.459950] IPTables-Dropped2: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=57133 PROTO=UDP SPT=57433 DPT=8612 LEN=24

Aug 8 18:59:40 user kernel: [31777.459953] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=57133 PROTO=UDP SPT=57433 DPT=8612 LEN=24

Aug 8 18:59:40 user kernel: [31777.461083] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=38280 PROTO=UDP SPT=53684 DPT=8612 LEN=24

Aug 8 18:59:40 user kernel: [31777.461089] IPTables-Dropped2: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=38280 PROTO=UDP SPT=53684 DPT=8612 LEN=24

Aug 8 18:59:40 user kernel: [31777.461093] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=38280 PROTO=UDP SPT=53684 DPT=8612 LEN=24

Aug 8 18:59:40 user kernel: [31777.461096] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=38280 PROTO=UDP SPT=53684 DPT=8612 LEN=24

Aug 8 18:59:42 user kernel: [31780.025003] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:42 user kernel: [31780.025009] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:42 user kernel: [31780.025013] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:45 user kernel: [31783.100450] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:45 user kernel: [31783.100457] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:45 user kernel: [31783.100461] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=0.0.0.0 DST=255.255.255.255 LEN=308 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=288

Aug 8 18:59:47 user kernel: [31784.533540] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=3013 PROTO=UDP SPT=58086 DPT=8612 LEN=24

Aug 8 18:59:47 user kernel: [31784.533546] IPTables-Dropped2: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=3013 PROTO=UDP SPT=58086 DPT=8612 LEN=24

Aug 8 18:59:47 user kernel: [31784.533550] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=192.168.0.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=3013 PROTO=UDP SPT=58086 DPT=8612 LEN=24

Aug 8 18:59:47 user kernel: [31784.534631] IPTables-Dropped1: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=18960 PROTO=UDP SPT=65462 DPT=8612 LEN=24

Aug 8 18:59:47 user kernel: [31784.534637] IPTables-Dropped2: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=18960 PROTO=UDP SPT=65462 DPT=8612 LEN=24

Aug 8 18:59:47 user kernel: [31784.534641] IPTables-Dropped3: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=18960 PROTO=UDP SPT=65462 DPT=8612 LEN=24

Aug 8 18:59:47 user kernel: [31784.534645] IPTables-Dropped4: IN=wlp5s0 OUT= MAC=xxx SRC=192.168.0.13 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=18960 PROTO=UDP SPT=65462 DPT=8612 LEN=24

As it is not possible in iptables to just e.g. block several IPs separated by comma in one command (which would solve the problem), is there another way to do it?

I am aware that there is netfilter and other, perhaps more professional tools to log (dropped) packets, but I would like to do it with iptables if somehow possible.

Any help but be appreciated.

Improve this question

1 Answer 1

Reset to default
0

Change AS follows

-N LOGGING
-N NOLOG
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m conntrack -j ACCEPT  --ctstate RELATED,ESTABLISHED 
-A INPUT -i wlp5s0 -d 192.168.0.0/25 -m state --state NEW -j NOLOG 
-A INPUT -i wlp5s0 -d 255.255.255.255  -m state --state NEW -j NOLOG
-A INPUT -i wlp5s0 -d 0.0.0.0 -m state --state NEW -j NOLOG 
-A INPUT -i wlp5s0 -d 192.168.0.255 -m state --state NEW -j NOLOG
-A INPUT -j LOGGING
-A LOGGING -m state --state NEW  ! --dport 22 -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
-A LOGGING -j DROP
Then decide between
-A NOLOG -j DROP 
or
-A NOLOG -j ACCEPT

All the traffic you don't want logged takes a different road now. without RELATED,ESTABLISHED you may block all communications.

If you are allowing ssh from the internet you need fail-to-ban as ssh is one of the most attacked port on the internet.

If your exposed to the internet be prepared for 2000+ a day log entries. You are better off not logging them. I don't know if you plan to analyze these logs but be warned if you do it manually you will need hours a day for this task. I have a ban list and the ban list grow by 100 unique IP a day.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .