I use Ubuntu to host my web sites. I would like to generate a log of every IP address that "touches" my Ubuntu installation - including ping, port scans, etc, not just http requests. What would be an efficient way to accomplish this task?
LOG target writes messages in kernel log. Syslogd is often configured to write these messages to a log file. These messages can also be viewed with
It is also possible to use
AUDIT target for logging, in which case logs are written to audit log by auditd. When you write a rule with
AUDIT target, you need to specify audit record type via
Accept packet associated with established connections.
iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
Other packet are logged (with a rate limit). A prefix to be included in log can be set with
iptables -A INPUT -m limit --limit 5/min -j LOG \ --log-prefix "iptables: " --log-level info
Note that iptables rules are evaluated in order. Processing stops at first matching rule to
LOG target does not stop processing.