2.23.1 ProblemYou want your firewall to log and drop certain packets. 2.23.2 SolutionFor iptables, create a new rule chain that logs and drops in sequence: # iptables -N LOG_DROP # iptables -A LOG_DROP -j LOG --log-level warning --log-prefix "dropped" -m limit # iptables -A LOG_DROP -j DROP Then use it as a target in any relevant rules: # iptables ...specification... -j LOG_DROP For ipchains: # ipchains ...specification... -l -j DROP 2.23.3 Discussioniptables's LOG target causes the kernel to log packets that match your given specification. The log-level option sets the syslog level [Recipe 9.27] for these log messages and log-prefix adds an identifiable string to the log entries. The further options log-prefix, log-tcp-sequence, log-tcp-options, and log-ip-options affect the information written to the log; see iptables(8). LOG is usually combined with the limit module (-m limit) to limit the number of redundant log entries made per time period, to prevent flooding your logs. You can accept the defaults (3 per hour, in bursts of at most 5 entries) or tailor them with limit and limit-burst, respectively. ipchains has much simpler logging: just add the -l option to the relevant rules. 2.23.4 See Alsoiptables(8), ipchains(8). |