Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Suppose I add an IP to iptables blocking for exim, dovecot and FTP and this IP visits my server again.

Is there any log of this visit so I can confirm the IP was trying to reach the server again but was blocked?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Try doing this :

iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
share|improve this answer
    
thanks! PERFECT –  SpaceDog Apr 12 '13 at 10:20

If you block a specific IP address (or net) you can view the hit count of the blocking rule via iptables -L -vn. If the counters for packets and bytes increase, the IP address/net has visited again.

If you need the information logged you can use the LOG target in iptables:

/sbin/iptables -A INPUT -p tcp -m multiport --dports 20,21,25,143 -j LOG --log-prefix "iptables: "
/sbin/iptables -A INPUT -p tcp -m multiport --dports 20,21,25,143 -j DROP

The first line logs the connection attempt (to syslog or whatever you have configured) prefixing it with "iptables: " so you can grep more easily or have the output redirected by syslog to a special iptables.log for example. A LOG-jump always returns to the chain where the connection attempt is now dropped by the second rule.

Also see @sputnick's answer for additionally rate limiting those log entries to prevent logspam.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.