JIYIK CN >

This article is part of our ongoing series on Linux iptables. When our iptables rules are not working as expected, we may need to log the packets dropped by iptables for troubleshooting. This article explains how to log incoming and outgoing dropped firewall packets.

If we are new to iptables, please familiarize yourself with the basic concepts of iptables first .

Log all dropped input packets

First, we need to understand how to log all dropped iptables input packets to syslog.

If we already have a bunch of iptables firewall rules, add these to the bottom, this will log all dropped input packets (incoming) to /var/log/messages

$ iptables -N LOGGING
$ iptables -A INPUT -j LOGGING
$ iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
$ iptables -A LOGGING -j DROP

In the example above, it does the following:

• iptables -N LOGGING: Create a new chain called LOGGING
• iptables -A INPUT -j LOGGING: All remaining incoming packets will jump to the LOGGING chain
• Line 3: Log incoming packets to syslog (/var/log/messages). This line is explained in detail below.
• iptables -A LOGGING -j DROP: Finally, all packets that reach the LOGGING chain are dropped. That is, now it actually drops incoming packets.

In line 3 above, it has the following options for logging dropped packets:

• -m limit : This uses the limit matching module. Using it, you can limit logging using the --limit option.
• --limit 2/min : This indicates the maximum average match rate for the log records. In this example, it limits the records to 2 per minute for similar packets. We can also specify 2/second, 2/minute, 2/hour, 2/day. This is helpful when we don't want to confuse the log messages with duplicate messages of the same dropped packets.
• -j LOG : Indicates that the target of this package is LOG, that is, writing to the log file.
• --log-prefix "IPTables-Dropped:" We can specify any log prefix which will be appended to the log messages that will be written to the /var/log/messages file
• --log-level 4 This is the standard system log level. Four is warning. We can use numbers in the range of 0 to 7. 0 is emergency and 7 is debug.

Log all dropped outgoing packets

This is the same as above, but the second line below has OUTPUTinstead of INPUT.

iptables -N LOGGING
iptables -A OUTPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

Log all dropped packets (incoming and outgoing)

This is the same as before, but we'll take line 2 from the previous two examples and add it here. That is, we'll have a separate line for INPUTand , which will jump into the LOGGING chain.OUTPUT

To log incoming and outgoing dropped packets, add the following lines at the bottom of your existing iptables firewall rules.

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A OUTPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

Also, as we explained before, by default, iptables will use /var/log/messages to log all messages. If we want to change this to our own custom log file, add the following line to /etc/syslog.conf

kern.warning   /var/log/custom.log

How to read iptables logs

The following are examples of lines logged in /var/log/messages when incoming and outgoing packets are dropped .

Aug  4 13:22:40 centos kernel: IPTables-Dropped: IN= OUT=em1 SRC=192.168.1.23 DST=192.168.1.20 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=59228 SEQ=2
Aug  4 13:23:00 centos kernel: IPTables-Dropped: IN=em1 OUT= MAC=a2:be:d2:ab:11:af:e2:f2:00:00 SRC=192.168.2.115 DST=192.168.1.23 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=9434 DF PROTO=TCP SPT=58428 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0

In the above output:

• IPTables-Dropped : This is the prefix we use in logging by specifying the --log-prefix option
• IN=em1 This represents the interface used for this incoming packet. For outgoing packets this will be empty
• OUT=em1 This represents the interface used for outgoing packets. For incoming packets this will be empty.
• SRC = source IP address where the packet originated
• DST = the destination IP address to which the packet is sent
• LEN = packet length
• PROTO= indicates the protocol (as shown above, the first line is the outgoing ICMP protocol, and the second line is the incoming TCP protocol)
• SPT= indicates source port
• DPT= stands for destination port. In line 2 above, the destination port is 443. This means that the incoming HTTPS packets are dropped.