I am trying to set up IP Tables on CentOS 7 which I've done in the past but for some reason I can't get it to log the dropped packets like I'd expect. In the ip tables config I have the following
*filter -A INPUT -i lo -j ACCEPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A OUTPUT -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited # Log and drop packets that don't match the above rules -N LOGGING -A INPUT -j LOGGING -A OUTPUT -j LOGGING -A LOGGING -j LOG --log-prefix "IPTables-Dropped: " --log-level 6 -A LOGGING -j REJECT -A INPUT -j REJECT -A OUTPUT -j REJECT COMMIT
As you can see I only have port 22 (SSH) open so I would expect if I try and do an HTTP request, because this isn't allowed in the firewall, it would block the request (which it does) but I should also see in /var/log/messages the log line
IPTables-Dropped which I don't.
I've also tried updating /etc/rsyslog.conf and added
kern.warn /var/log/messages but doesn't make any difference (I did restart rsyslog service).