Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose I add an IP to iptables blocking for exim, dovecot and FTP and this IP visits my server again.

Is there any log of this visit so I can confirm the IP was trying to reach the server again but was blocked?

share|improve this question
up vote 3 down vote accepted

Try doing this :

iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
share|improve this answer
thanks! PERFECT – SpaceDog Apr 12 '13 at 10:20
Doesn't this log everything? This very same command on my server made it unresponsive. – Ken Sharp Jan 4 at 3:44

If you block a specific IP address (or net) you can view the hit count of the blocking rule via iptables -L -vn. If the counters for packets and bytes increase, the IP address/net has visited again.

If you need the information logged you can use the LOG target in iptables:

/sbin/iptables -A INPUT -p tcp -m multiport --dports 20,21,25,143 -j LOG --log-prefix "iptables: "
/sbin/iptables -A INPUT -p tcp -m multiport --dports 20,21,25,143 -j DROP

The first line logs the connection attempt (to syslog or whatever you have configured) prefixing it with "iptables: " so you can grep more easily or have the output redirected by syslog to a special iptables.log for example. A LOG-jump always returns to the chain where the connection attempt is now dropped by the second rule.

Also see @sputnick's answer for additionally rate limiting those log entries to prevent logspam.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.