Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been using iptables for some time but recently noticed that the log prefix I'd set had got corrupted. In /etc/iptables/rules.v4` I have:

-A LOGNDROP -j LOG --log-prefix "iptables denied: " --log-level 7

I found that in /var/log/syslog I actually have records like

Jul 25 20:10:04 zotac kernel: [688421.696561] --log-prefixIN=wlan0 OUT= MAC=1c:4b:d6:ee:a9:64:00:24:17:0c:a7:ef:08:00 SRC= DST= LEN=40 TOS=0x00 PREC=0x00 TTL=44 ID=36871 PROTO=TCP SPT=587 DPT=60497 WINDOW=0 RES=0x00 RST URGP=0

Where the log prefix has somehow got set to --log-prefix.I can fix this by executing:

 ~# iptables -R LOGNDROP 1 -j LOG --log-prefix "iptables denied: " --log-level 7

But why is this happening and how do I fix it?

FYI: Debian Wheezy [Linux version 3.2.0-2-686-pae (Debian 3.2.20-1)] with iptables [1.4.14-2] and iptables-persistent [0.5.3+nmul]

share|improve this question

It seems it's a bug in iptables-restore.

See here on bugzilla or here on Debian bugs

Basically, iptables-restore can't parse arguments in double quotes (which is what iptables-save writes the log prefix as) so picks up the previous token, which is the string --log-prefix itself!

The solution is to upgrade to iptables 1.4.14-3 (currently in Debian sid/unstable).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.