Recipe 2.23 Logging Simplified

2.23.1 Problem

You want your firewall to log and drop certain packets.

2.23.2 Solution

For iptables, create a new rule chain that logs and drops in sequence:

# iptables -N LOG_DROP
# iptables -A LOG_DROP -j LOG --log-level warning --log-prefix "dropped" -m limit
# iptables -A LOG_DROP -j DROP

Then use it as a target in any relevant rules:

# iptables ...specification... -j LOG_DROP

For ipchains:

# ipchains ...specification... -l -j DROP

2.23.3 Discussion

iptables's LOG target causes the kernel to log packets that match your given specification. The ?log-level option sets the syslog level [Recipe 9.27] for these log messages and ?log-prefix adds an identifiable string to the log entries. The further options ?log-prefix, ?log-tcp-sequence, ?log-tcp-options, and ?log-ip-options affect the information written to the log; see iptables(8).

LOG is usually combined with the limit module (-m limit) to limit the number of redundant log entries made per time period, to prevent flooding your logs. You can accept the defaults (3 per hour, in bursts of at most 5 entries) or tailor them with ?limit and ?limit-burst, respectively.

ipchains has much simpler logging: just add the -l option to the relevant rules.