9

I am trying to log all my outbound connections to a file using iptables.

This is my rule:

-A OUTPUT ! -o lo ! --destination 127.0.0.1  -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7

However, if I add another IP destination (multicast) so my rule becomes this:

-A OUTPUT ! -o lo ! --destination 127.0.0.1 ! --destination 239.192.0.0 -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7

I get the following error:

multiple -d flags not allowed

My question is not what does the error mean, but rather how can I exclude multiple IP addresses in my rule? The two conditions

! --destination 127.0.0.1

and

! --destination 239.192.0.0

are mutually exclusive so having two rules would effectively be like not having them at all (only worse, as I would get nearly twice the logs)

So is there an "and" operator?

3 Answers 3

12

For problems of this kind you can define new chains and jumping between them. You might for example add a chain LOGGING and at the beginning of this chain match those packets you don't want to log with an action of RETURN:

$ iptables -N LOGGING
$ iptables -A LOGGING -d 127.0.0.0/8 -j RETURN
$ iptables -A LOGGING -d 239.192.0.0/16 -j RETURN
$ iptables -A LOGGING -j LOG 
$ iptables -A OUTPUT -j LOGGING

This way, all packets coming through the OUTPUT chain would first go through the LOGGING chain and everything not being for 127.0.0.0/8 and 239.192.0.0/16 would be logged, then control would go back to the OUTPUT.

3

Yes, but it doesn't work the way you want. From the man page:

Multiple addresses can be specified, but this will expand to multiple rules (when adding with -A), or will cause multiple rules to be deleted (with -D).

The way to do this is to add rules earlier in the chain to divert the traffic you don't want to log or modify, e.g.

-A OUTPUT -o lo -j ACCEPT
-A OUTPUT --destination 239.192.0.0 -j ACCEPT
-A OUTPUT  -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7
3
  • It should be possible to accept 2 answers. In the end I decided to give Andreas the reputation points. Thanks, though, and have an upvote! Apr 5, 2014 at 16:28
  • 1
    I thought about this answer, too, but the chain-approach has the advantage, that you don't infer with potential additional rules coming after the logging (probably you want to do further filtering and having ACCEPTed some addresses could mess with this). Apr 5, 2014 at 16:30
  • 2
    Thanks! Andreas's answer is cleaner, so the accept is well deserved.
    – Mikel
    Apr 5, 2014 at 16:30
2

You can use comma separated values with -d or -s to set multiple IPs. (See discussion at http://www.gossamer-threads.com/lists/gentoo/user/210361)

For instance, command

sudo iptables -A OUTPUT -d 192.168.235.43,192.168.235.46 -j DROP

filters traffic to two servers.

1
  • 5
    Best answer, but bear in mind that doesn't work with '!'. Dec 29, 2015 at 13:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .