1

I am trying to set up IP Tables on CentOS 7 which I've done in the past but for some reason I can't get it to log the dropped packets like I'd expect. In the ip tables config I have the following

*filter
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited



# Log and drop packets that don't match the above rules
-N LOGGING
-A INPUT -j LOGGING
-A OUTPUT -j LOGGING
-A LOGGING -j LOG --log-prefix "IPTables-Dropped: " --log-level 6
-A LOGGING -j REJECT
-A INPUT -j REJECT
-A OUTPUT -j REJECT
COMMIT

As you can see I only have port 22 (SSH) open so I would expect if I try and do an HTTP request, because this isn't allowed in the firewall, it would block the request (which it does) but I should also see in /var/log/messages the log line IPTables-Dropped which I don't.

I've also tried updating /etc/rsyslog.conf and added kern.warn /var/log/messages but doesn't make any difference (I did restart rsyslog service).

1

Order of rules does matter.

This rule:

-A INPUT -j REJECT --reject-with icmp-host-prohibited

precedes this rule:

-A INPUT -j LOGGING

preventing it to ever be executed: no logging.

Same for other chains.

Just use iptables-save to output a "refreshed" version of your rules, and edit their order accordingly.

Also read this link about the (very rarely happening) problem of using REJECT without first DROP-ing INVALID states.

| improve this answer | |
  • Thanks that was it, I knew the order mattered, but I thought the --reject-with icmp... was related to blocking ICMP traffic such as ping and tracert – Boardy Jun 5 at 15:34
  • no, you'd place the icmp filter before (-p icmp would be enough). Note that blindly filtering all ICMP can cause other issues, especially about PMTUD (and thus VPN tunnels). – A.B Jun 5 at 15:39
  • Thanks for the extra info, don't think I'll be needing PMTUD from a quick look and definetely won't be using VPN tunnels. – Boardy Jun 5 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.