0

I'm using ufw on Ubuntu 18.04 LTS, and I want to log both dropped and accepted packets (I am aware this will generate a lot of logs).

I can do this by increasing the ufw log level with ufw logging high - but I also want to log some additional information that isn't included by default (TCP options and sequence number), so that's not going to work for me.

I believe the correct place to add custom logging rules is /etc/ufw/before.rules, and I've added this at the end of the file, just before the COMMIT:

-A INPUT -j LOG --log-tcp-options --log-tcp-sequence --log-prefix "[MY_PREFIX] "
-A FORWARD -j LOG --log-tcp-options --log-tcp-sequence --log-prefix "[MY_PREFIX] "

However, this is only logging dropped packets, not accepted ones. I guess this is something to do with the order of iptables rules, but I don't see anything else in before.rules that would short-circuit logging of accepted packets.

A couple of further constraints are that I don't want to log any outbound connections, or any loopback traffic.

Any ideas on how I can log both dropped and accepted packets with extra information?

1 Answer 1

0

-A appends rules at the end of the iptables chain.

If you want to log every packet, before anything else, try using -I:

-I INPUT -j LOG --log-tcp-options --log-tcp-sequence --log-prefix "[MY_PREFIX] "
-I FORWARD -j LOG --log-tcp-options --log-tcp-sequence --log-prefix "[MY_PREFIX] "

That said, the best way to address these issues is to create new chains and modify your rules to use those chains instead of the standard ones.

As a (simple) example, you can have two new targets:

iptables -N LOG_DROP
iptables -N LOG_ACCEPT

and create "default" rules as

iptables -A LOG_DROP -j LOG --log-tcp-options --log-tcp-sequence --log-prefix "[MY_PREFIX] "
iptables -A LOG_DROP -j DROP

iptables -A LOG_ACCEPT -j LOG --log-tcp-options --log-tcp-sequence --log-prefix "[MY_PREFIX] "
iptables -A LOG_ACCEPT -j ACCEPT

Then on your rules you can "send" to LOG_DROP instead of DROP and LOG_ACCEPT instead of ACCEPT:

iptables -A INPUT -p tcp --dport 22 -j LOG_DROP # Log and drop input packets to port 22
2
  • A couple of further constraints I forgot to menion are that I don't want to log outbound traffic, or loopback traffic - are any changes needed for that? before.rules already contains some stuff related to loopback at least, but I'm not sure if that has any impact
    – Cocowalla
    Commented Sep 10, 2018 at 8:51
  • @Cocowalla simply -j LOG_* only in chains you need, i.e. INPUT and FORWARD. I'll update my answer. Commented Sep 10, 2018 at 8:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .