8

I'm trying to log dropped packages to a custom file instead of /var/log/messages.

To achieve this, I have added these two lines at the end of my configuration file:

    -A INPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-INPUT-Dropped: " --log-level 4
    -A OUTPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-OUTPUT-Dropped: " --log-level 4

This works because I have configured the INPUT and OUTPUT chains as DROP by default, so if the package does not meet any previous rule, it will be logged and dropped.

However, I cannot log them to a custom file. They log successful to /var/log/messages, but I want them to be logged on /var/log/iptables.log. I've created the file /etc/rsyslog.d/iptables.conf with the following content:

    :msg, contains, "IPTables-INPUT-Dropped: " - /var/log/iptables.log
    & ~

then I restarted rsyslog, /etc/init.d/rsyslog restart and sent some packages I knew were going to be dropped.However, they are not logged in iptables.log, they are still being logged on /var/log/messages.

Which configuration is missing?

SOLVED The problem is that there shouldn't be an space between - and /

2
  • That should work (I use it). However, I have it in /etc/rsyslog.conf before other directives, so that the message gets dropped before anything else picks it up. Try that and kill -HUP `pidof rsyslogd`. Maybe loose the space at the end of the quoted string.
    – goldilocks
    Aug 31, 2013 at 15:03
  • I've added the first line to rsyslog.conf but still it doesn't work
    – user27807
    Aug 31, 2013 at 15:24

5 Answers 5

4

The problem is that there shouldn't be a space between - and /

3

This can be possible using :

To disable iptables logs in syslog , do modification as below in /etc/rsyslog.d/50-default.conf:

*.*;auth,authpriv.none;kern.*=!kern.warning             -/var/log/syslog

To log in separate file; append :

kern.=warning -/var/log/iptables.log

then once restart syslog or rsyslog and tail the logs

/etc/init.d/rsyslog restart

It's works in syslog and rsyslog also

2

This is a an alternative approach using ulogd. I would suggest this mechanism as it stops the kernel logging mechanism -m LOG uses (which has the grievous side effect of filling your dmesg log as well).

First you'll need ulogd, which you can get with an apt-get install ulogd. Edit your /etc/ulogd.conf, enable this module (by removing the # at the start of the line):

plugin="/usr/lib/ulogd/ulogd_LOGEMU.so"

and change/add the section [LOGEMU]:

[LOGEMU]
file="/var/log/iptables.log"
sync=1

And then restart your ulogd with /etc/init.d/ulogd restart. Then instead of -j LOG use -j ULOG on your iptables rules. The ULOG module has no concept of --log-level so you can remove those options. It also uses --ulog-prefix instead of --log-prefix.

13
  • it does not work.
    – user27807
    Aug 31, 2013 at 15:27
  • Did you restart the ulogd after adding the entry? (/etc/init.d/ulogd restart as root)
    – Drav Sloan
    Aug 31, 2013 at 15:28
  • yeah, of course. Actually it is ulogd2 rather than ulogd
    – user27807
    Aug 31, 2013 at 15:29
  • ah you need another step will add it to the answer.
    – Drav Sloan
    Aug 31, 2013 at 15:31
  • Nop, it comes enabled by default.
    – user27807
    Aug 31, 2013 at 15:36
2

FYI:

& ~ is deprecated in the new rsyslog, you should use stop instead.

/etc/rsyslog.d/10-iptables

if ( $msg contains 'IN=' and $msg contains 'OUT=' ) 
then { 
    /var/log/10-iptables.log
    stop
}

/etc/logrotate.d/iptables

/var/log/iptables.log
{
        rotate 30
        daily
        missingok
        notifempty
        delaycompress

        postrotate
                service rsyslog rotate > /dev/null
        endscript
}

Note i set the prefix to 10- to catch it before it reach the default rules (50-defaults).

0

A working solution with ulogd

a)Ensure you have this module on start

modprobe nf_log_ipv4
cp /etc/modules /etc/modules.bak
echo nf_log_ipv4 >> /etc/modules

b)edit the file /etc/ulogd.conf enable those plugin(uncomment #)

plugin="/usr/lib64/ulogd/ulogd_inppkt_NFLOG.so"
plugin="/usr/lib64/ulogd/ulogd_filter_IFINDEX.so"
plugin="/usr/lib64/ulogd/ulogd_filter_IP2STR.so"
plugin="/usr/lib64/ulogd/ulogd_filter_PRINTPKT.so"
plugin="/usr/lib64/ulogd/ulogd_output_LOGEMU.so"
plugin="/usr/lib64/ulogd/ulogd_raw2packet_BASE.so"

add this line before the first commented # stack

stack=firewall11:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu11:LOGEMU

and finally at the end of file add those lines

[firewall11]
group=11

[emu11]
file="/var/log/iptables.log"
sync=1

c) Now, I prefer to use old method of iptables script instead of firewalld, in my iptables script I use those lines for logging.

# Log
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A FORWARD -j NFLOG
iptables -A LOGGING -j NFLOG --nflog-prefix "[firewall-drop]:" --nflog-group 11
iptables -A LOGGING -j DROP

d) the final parts

touch /var/log/iptables.log
systemctl restart ulogd

Verify if work with this command

tail -f /var/log/iptables.log

You should see some lines after an event: nmap portscan, or simply telnet to your machine(hope is disabled or firewalled).

You must log in to answer this question.