5

I blocked an abusive IP from a CentOS server using iptables, dropping all connection attempts on all services / ports.

As is the way of things, the server with this IP may have been part of a botnet, and may have been cleaned in the time since I blocked it. I would like to find out if it's still trying to attack the server, so I can decide whether to unblock the IP... without unblocking it first.

I have tried searching through /var/log for anything that looks like iptables, grepped /var/log/secure for the offending IP, but have turned up nothing.

Is there a log of dropped connection attempts for iptables, or a way to configure the rule to log attempts but still drop them?

6

In addition to the other answers, iptables -v -L lists the counts of packets and bytes that traverse a given rule, so you can see how much traffic you're dropping, and I wouldn't be too hard to write a tool that parses and reports that info.

  • good point - I was able to check this now, without modifying any rules, by running the command once and then again after 30 minutes and comparing the traffic - no increase means no further attempts have been made in that timeframe. All the answers here are great though, thanks to all. I've changed this to the accepted answer as this was what I used to solve the problem, the others are still valid. – jammypeach May 6 '16 at 16:28
4

You need to explicitly log the packets, using the LOG target. You'd add a rule in your chains with the same criteria as the DROP rule for the abusive IP, but using -j LOG instead of -j DROP.

In addition you can specify the log prefix using --log-prefix, and a log level using --log-level. It's also common to specify rate limits to avoid flooding the logs... See the iptables documentation for details.

3

You'll need to set up a logging chain for your dropped packets. There is a good tutorial on doing that at http://www.thegeekstuff.com/2012/08/iptables-log-packets/ which boils down to adding something similar to the following to your current ruleset:

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.