0

I have got iptables on my centos 7. My firewalld is disabled. How can I log my iptables events? On debian it is dmesg option but I don't know how to set it on centos.

I want to log all of my iptables events. Not specific rule.

  • Are you asking how to enable or how to see the logs? Because frankly, dmesg won't enable logging of netfilter rules, you'll have to tell netfilter to log matching packets using the LOG target (and that's independent of the question if this is Debian or CentOS). – 0xC0000022L Feb 13 '18 at 10:23
2

When a packet matches a iptables ... -j LOG rule, a kernel log message is generated. You can specify the severity level of the message using the --log-level <level> option, where the <level> can be one of the standard syslog level identifiers: emerg, alert, crit, error, warning, notice, info or debug.

These log messages are processed by rsyslog: if the severity level is low enough, rsyslog may completely discard the messages. Since the iptables log messages come from the kernel, their logging category will always be kern. So look into /etc/rsyslog.conf to see which is the minimum severity level for kern.* messages to be acted on, and into which log file they will be stored into. Then set an appropriate severity level to your iptables -j LOG rules.

Or use the iptables ... -j LOG --log-prefix <prefix> option to add an identifiable prefix to iptables messages, and then use the advanced features of rsyslog to write the iptables messages into a separate log file.

  • I want to log all of my iptables events. Not specific rule. – debek Feb 14 '18 at 7:43
  • Then place a LOG rule at the start of INPUT, OUTPUT and FORWARD chains. You will then get a log message of every IP packet your system sends and receives. This may be useful in some troubleshooting situations in isolated networks, but in a typical internet-connected system it is just a good way to fill up your disk with logs. Or... please describe what you think of as an "event"? – telcoM Feb 14 '18 at 9:02
1

I found the best solution for me: Warning level:

iptables -A INPUT -j LOG --log-prefix "BAD_INPUT: " --log-level 4
iptables -A FORWARD -j LOG --log-prefix "BAD_FORWARD: " --log-level 4
iptables -A OUTPUT -j LOG --log-prefix "BAD_OUTPUT: " --log-level 4

Debug level:

iptables -A INPUT -j LOG --log-prefix "BAD_INPUT: " --log-level 7
iptables -A FORWARD -j LOG --log-prefix "BAD_FORWARD: " --log-level 7
iptables -A OUTPUT -j LOG --log-prefix "BAD_OUTPUT: " --log-level 7

Logs are storred in:

/var/log/messages

Sample output:

Aug  4 13:22:40 centos kernel: BAD_INPUT: IN= OUT=em1 SRC=192.168.1.23 DST=192.168.1.20 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=59228 SEQ=2
Aug  4 13:23:00 centos kernel: BAD_INPUT: IN=em1 OUT= MAC=a2:be:d2:ab:11:af:e2:f2:00:00 SRC=192.168.2.115 DST=192.168.1.23 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=9434 DF PROTO=TCP SPT=58428 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0
0

You can enable logging by this command (for example for INPUT chain):

iptables -A INPUT -j LOG
0

iptables logs events to /var/log/messages in CentOS 7.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.