All Questions

Tagged with
Filter by
Sorted by
Tagged with
-2
votes
1answer
18 views

I enabled iptables logging from the command line. How do I undo this logging configuration?

I ran sudo iptables -A INPUT -p udp -j LOG --log-prefix "udp:" How do I make it stop?
0
votes
0answers
27 views

Packet capture with iptables/rsyslogd?

The usual way I know of capturing packets is with iptables/NFLOG/nflog-group and ulogd with libpcap.so built in. It's a simple matter to enable packet capture in the ulogd.conf file and all rules that ...
1
vote
1answer
54 views

IP Logging with Ubuntu Server

I use Ubuntu to host my web sites. I would like to generate a log of every IP address that "touches" my Ubuntu installation - including ping, port scans, etc, not just http requests. What would be an ...
1
vote
1answer
663 views

IPtables logging is not working in CentOS 7

I want to log all the traffic which comes in and out from the port X. I have followed below steps. Edited /etc/syslog.conf , /etc/rsyslog.conf , /etc/systemd/system/rsyslog.service.d/rsyslog.conf ...
0
votes
1answer
275 views

iptables: Logging connections on port 25/TCP

I have KVM virtualization. I have over 60 interfaces: vnet1-60 - virtual; vmbr0 - bridge; enp2s0f0 - PHYSOUT; I need to know how many connection make each vnet interface. I have a rule like: ...
1
vote
4answers
11k views

Log iptables events on centos 7

I have got iptables on my centos 7. My firewalld is disabled. How can I log my iptables events? On debian it is dmesg option but I don't know how to set it on centos. I want to log all of my iptables ...
0
votes
3answers
270 views

Protect against incorrect virtualhost requests in centos/apache

We run a CentOS Linux release 7.4 LAMP stack with Apache 2.4. On a monitoring dashboard, I keep track of various performance metrics, and one of those is "bad host requests" where the virtualhost ...
3
votes
1answer
618 views

iptables: LOG is not a valid target

I'm learning to configure firewall rules using iptables. For some reason, iptables does not recognize LOG as a valid target: ○ sudo iptables -A INPUT -p icmp -j LOG iptables: No chain/target/match by ...
1
vote
1answer
1k views

How to log only iptables messages into my /var/log/iptables.log?

I want to log only iptables message into /var/log/iptables.log. Here is my way. sudo vim /etc/rsyslog.conf kern.* -/var/log/iptables.log sudo vim /etc/rsyslog.d/iptables.conf :msg, startswith, ...
4
votes
1answer
1k views

iptables: No chain/target/match ULOG

I want to use ULOG and send firewall logs to ulogd2 iptables -A INPUT -i eth0 -j ULOG gives me following error: iptables: No chain/target/match by that name I have these LOG-related options ...
0
votes
3answers
614 views

dmesg display packet info while journalctl --dmesg show none on my centos?

# cat /proc/version Linux version 2.6.32-042stab125.5 (root@kbuild-rh6-x64.eng.sw.ru) (gcc version 4.4.6 20120305 (Red Hat 4.4.6-4) (GCC) ) #1 SMP Tue Oct 17 12:48:22 MSK 2017 For the logging chain ...
2
votes
2answers
253 views

how to log the ping action from 111.111.111.111 into /var/log/iptables.log?

My os :centos 7. yum remove firewalld yum install -y iptables yum install -y iptables-services I want to log all the ping from 111.1111.111.111 into iptables.log. cat /etc/rsyslog.conf kern.* /var/...
1
vote
1answer
482 views

Is it possible to customize iptables logging to syslog?

Let's say I have the following log entry from iptables to syslog: Nov 3 12:04:12 mypc kernel: [ 296.274134] Packet: IN=enp0s9 OUT=enp0s8 MAC=08:00:27:2f:77:23:08:00:27:86:42:0e:08:00 SRC=192.168....
3
votes
1answer
1k views

How to customize the format of iptable log info?

sudo iptables -A INPUT -p tcp --sport 80 -j LOG --log-ip-options To check the format of iptables log info. Feb 6 20:01:32 hwy kernel: [13004.628960] IN=eth0 OUT= MAC=00:30:40:50:40:d0:f8:32:e4:...
2
votes
2answers
485 views

Continuous multicast traffic from my router

I'm using an iptables firewall on my local Linux server. The log tells me that there is a continuous multicast on the network by my router (Fritz box). Is this a normal behaviour. Should I allow this ...
1
vote
0answers
75 views

Log internet access

For a WiFi hotspot I want to record each guest's internet access. Not the full data, only source/dest/timestamp/duration. I didn't found any open source software to do this. Question 1: does someone ...
2
votes
1answer
384 views

iptables LOG only once

I noticed that there are data in the iptables log that I don't need, so I was wondering if it's possible to change some configuration so that the log has less information, thus reducing the log's size....
4
votes
3answers
5k views

How do I see the iptables logs in systemd

I have a system with Debian Jessie. It comes with systemd. I want to see the kernel logs for iptables. I have a bunch of iptables and at the end I want to log what doesn't get allowed. I do it like ...
0
votes
1answer
421 views

iptables logging for all except ICMP

I have iptables firewalls and its logging for all DROP packets or Deny. I want to tell it to no LOG any packet for ICMP protocol. How do i tell that *filter :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :...
1
vote
1answer
744 views

iptables LOG only once

I run the following iptables commands to detect and log a port scan: iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m ...
2
votes
0answers
109 views

Detect which program is blocked by firewall

The linux firewall can show a lot of information in the LOG target, for example via --log-uid. How can the executable doing the network call be logged, too? I did not find anything in the FAQ, the ...
1
vote
1answer
707 views

Change iptables log format

Is it possible to change the log format of iptables ? I want to add the ssh_client in the log. I have already made an iptables rule for outgoing ssh iptables -I OUTPUT -p tcp --dport 22 -j LOG --...
1
vote
0answers
382 views

How do you tweak iptables limit rules on openSUSE Tumbleweed?

I have a fresh install of openSUSE Tumbleweed, it is logging a lot firewall related stuff due to my apple devices multicasting to enable airplay. Lines look like: Mar 14 12:45:13 server kernel: SFW2-...
1
vote
2answers
1k views

Why do iptables drop / log even if the appropriate packet should be accepted?

I'm setting up a server running Debian Jessie with some applications like iptables firewall, fail2ban, openvpn, apache, ... The iptables firewall is configured in the way, that it logs every packet ...
13
votes
1answer
12k views

What's the difference between ULOG and NFLog?

Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here). From looking at man iptables those two look quite alike. Except that ...
8
votes
4answers
8k views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have another ...
2
votes
1answer
2k views

Bad argument `127.0.0.1' in iptables

-A OUTPUT --destination ! '127.0.0.1' -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7 gives me Bad argument `127.0.0.1' What am I doing wrong? I used this docs : http://...
1
vote
0answers
51 views

Configure syslog.conf file [duplicate]

How can I configure /etc/syslog.conf file in order to save log information about iptables in a specific file. I want to save these information separately, so I can extract what I want easily and ...
4
votes
1answer
1k views

iptables change log

Somehow an iptables rule was added to one of my systems. Does (or can) iptables keep a log about when and (maybe) who made a rule change? If iptables itself can't, is there a wrapper that might do ...
7
votes
4answers
16k views

Configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit 5/...
4
votes
1answer
9k views

Log the dropped packets by IPTables only if its DROPPED by a specific rule

I have IPTables rules set on a Linux device. I have a particular rule to drop the packets, and I wish to log the packets only if they're dropped by that specific rule, and not by the other rules. ...
4
votes
2answers
1k views

Meaning of log entries from an iptables configuration

My router has Linux as its OS. The system log has a lot of rows about iptable and klogd that I don't understand, could someone explain them to me? The iptables setup: iptables -t nat -A PREROUTING -...
5
votes
2answers
519 views

What tool to execute a command on repeated syslog entries?

Occasionally, one VPS under my control gets bombarded with POP3 login attempts. They all fail, but the huge number of spawned processes and active connections pretty much amount to a DoS attack. When ...
6
votes
2answers
4k views

How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?

I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
6
votes
2answers
4k views

Is it possible to redirect a logging output of the iptables' LOG chain into a separate log file?

I don't want to mix iptables's log output with other system logs. How could I specify a dedicated log file for iptables LOG chains output?
3
votes
2answers
12k views

iptables log file

I have ubuntu and I want to know where can I find the log file of iptables? I find out /var/log/messages, but I am not sure this is a correct log file or not. And I also want to know when this log ...