In iptables i would to add logging to every place where DROP is called.

However since I could encounter different tables in a production environment, I would just like to extend all rules that contain the DROP target, I don't want to go through the tedious process of rewriting every rule manually. Hence, I wonder - Is there a way to just change or add a log-prefix in a number of matching rules in order to add a custom string, say "DROPPED" ...? This way, if I add a similar entry in the PREROUTING table I can detect all the packets in a range of ports where PREROUTING is not followed by DROPPED, which would indicate a packet passthrough, which is ultimately what I would like to detect.

Either this way, or if there is another better way...

| improve this question | | | | |

Here is one of the best options.

iptables -N myDrop
iptables -A myDrop -j LOG --log-prefix "dropping " --log-level 7 --log-tcp-sequence --log-tcp-options --log-ip-options
iptables -A myDrop -j DROP

Now instead of doing a -j DROP do -j myDrop and it will be logged.

You can setup ulogd and log to a number of other destinations including a database.

iptables -A myDrop -j NFLOG --nflog-prefix  banned_hosts --nflog-group 1
| improve this answer | | | | |
  • That is kind of what I am doing. Problem is DROP but also REJECT (DROP with ICMP response) are all over the place which forces me to manipulate the firewall extensively and manually, thereby also risk making a mistake. – JohnyTex Jun 7 '18 at 8:03
  • by starting a new chain you only have to reference the new chain, and it will log and drop for you. There shouldn't be DROP and REJECT rules everywhere. It should be -j myDrop and -j myReject and the chain with the matching name does all the heavy lifting. – cybernard Jun 7 '18 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.