* Please ... how can i log all packets dropped ?
@ 2003-07-19 17:38 Juliano Murlick
2003-07-19 19:49 ` David Busby
2003-07-19 22:05 ` Ramin Dousti
0 siblings, 2 replies; 6+ messages in thread
From: Juliano Murlick @ 2003-07-19 17:38 UTC (permalink / raw)
To: netfilter
[-- Attachment #1: Type: text/plain, Size: 706 bytes --]
Hello ALL,
I need log all packet dropped on my firewall, how can i get it ? I know how
log all that i accept, like this:
iptables -A FORWARD -p tcp -s $REDELOCAL --sport 1024:65535 -d $SSHSRV
--sport 22 -j LOG
iptables -A FORWARD -p tcp -s $REDELOCAL --sport 1024:65535 -d $SSHSRV
--sport 22 -j ACCEPT
i will LOG all packet from ssh connection, but i don't to log all packet
dropped, my default policy is DROP:
iptables -P FORWARD DROP
please, if anyone knows it ? tell me ....
Thanks in advance!
Att,
Juliano Murlick
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
[-- Attachment #2: Type: text/html, Size: 2406 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Please ... how can i log all packets dropped ?
2003-07-19 17:38 Please ... how can i log all packets dropped ? Juliano Murlick
@ 2003-07-19 19:49 ` David Busby
2003-07-19 21:01 ` Juliano Murlick
2003-07-19 22:05 ` Ramin Dousti
1 sibling, 1 reply; 6+ messages in thread
From: David Busby @ 2003-07-19 19:49 UTC (permalink / raw)
To: jmurlick, netfilter
At the end of the rules say -j LOG, any packet that makes it that far will
then be droped by the policy.
----- Original Message -----
From: "Juliano Murlick" <jmurlick@sicredi.com.br>
To: <netfilter@lists.netfilter.org>
Sent: Saturday, July 19, 2003 10:38
Subject: Please ... how can i log all packets dropped ?
> Hello ALL,
> I need log all packet dropped on my firewall, how can i get it ? I know
> how log all that i accept, like this:
>
> iptables -A FORWARD -p tcp -s $REDELOCAL --sport 1024:65535 -d $SSHSRV
> --sport 22 -j LOG
> iptables -A FORWARD -p tcp -s $REDELOCAL --sport 1024:65535 -d $SSHSRV
> --sport 22 -j ACCEPT
>
> i will LOG all packet from ssh connection, but i don't to log all
> packet dropped, my default policy is DROP:
>
> iptables -P FORWARD DROP
>
> please, if anyone knows it ? tell me ....
>
>
> Thanks in advance!
>
> Att,
> Juliano Murlick
>
>
>
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
>
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Please ... how can i log all packets dropped ?
2003-07-19 19:49 ` David Busby
@ 2003-07-19 21:01 ` Juliano Murlick
0 siblings, 0 replies; 6+ messages in thread
From: Juliano Murlick @ 2003-07-19 21:01 UTC (permalink / raw)
To: netfilter
I don't understant ... i can't do some thing like this:
iptables -P FORWARD -j LOG
I have to do a rule for any kinf of packet that I wanna log ?
ATs,
Juliano Murlick
SICREDI Serviços - Tecnologia
jmurlick@sicredi.com.br
(51) 3358-4977 / (51) 9951-3888
-----Original Message-----
From: David Busby [mailto:busby@pnts.com]
Sent: sábado, 19 de julho de 2003 16:50
To: jmurlick@sicredi.com.br; netfilter@lists.netfilter.org
At the end of the rules say -j LOG, any packet that makes it that far will
then be droped by the policy.
----- Original Message -----
From: "Juliano Murlick" <jmurlick@sicredi.com.br>
To: <netfilter@lists.netfilter.org>
Sent: Saturday, July 19, 2003 10:38
Subject: Please ... how can i log all packets dropped ?
> Hello ALL,
> I need log all packet dropped on my firewall, how can i get it ? I know
> how log all that i accept, like this:
>
> iptables -A FORWARD -p tcp -s $REDELOCAL --sport 1024:65535 -d $SSHSRV
> --sport 22 -j LOG
> iptables -A FORWARD -p tcp -s $REDELOCAL --sport 1024:65535 -d $SSHSRV
> --sport 22 -j ACCEPT
>
> i will LOG all packet from ssh connection, but i don't to log all
> packet dropped, my default policy is DROP:
>
> iptables -P FORWARD DROP
>
> please, if anyone knows it ? tell me ....
>
>
> Thanks in advance!
>
> Att,
> Juliano Murlick
>
>
>
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
>
>
>
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Please ... how can i log all packets dropped ?
2003-07-19 17:38 Please ... how can i log all packets dropped ? Juliano Murlick
2003-07-19 19:49 ` David Busby
@ 2003-07-19 22:05 ` Ramin Dousti
2003-07-21 12:44 ` Juliano Murlick
1 sibling, 1 reply; 6+ messages in thread
From: Ramin Dousti @ 2003-07-19 22:05 UTC (permalink / raw)
To: Juliano Murlick; +Cc: netfilter
On Sat, Jul 19, 2003 at 02:38:01PM -0300, Juliano Murlick wrote:
> Hello ALL,
> I need log all packet dropped on my firewall, how can i get it ? I know how
> log all that i accept, like this:
If I understand your question correctly:
If you want to log the dropped packets only then you must allow the ones
you want in the beginning of your rule set and the very last rule (right
before the default DROP policy) must be LOG.
Ramin
>
> iptables -A FORWARD -p tcp -s $REDELOCAL --sport 1024:65535 -d $SSHSRV
> --sport 22 -j LOG
> iptables -A FORWARD -p tcp -s $REDELOCAL --sport 1024:65535 -d $SSHSRV
> --sport 22 -j ACCEPT
>
> i will LOG all packet from ssh connection, but i don't to log all packet
> dropped, my default policy is DROP:
>
> iptables -P FORWARD DROP
>
> please, if anyone knows it ? tell me ....
>
>
> Thanks in advance!
>
> Att,
> Juliano Murlick
>
>
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Please ... how can i log all packets dropped ?
2003-07-19 22:05 ` Ramin Dousti
@ 2003-07-21 12:44 ` Juliano Murlick
2003-07-21 14:29 ` Ramin Dousti
0 siblings, 1 reply; 6+ messages in thread
From: Juliano Murlick @ 2003-07-21 12:44 UTC (permalink / raw)
To: 'Ramin Dousti', netfilter
Maybe I did my question wrong ... Sorry.
I wanna LOG all packet dropped, but I don’t wanna do one rule for each port
or kind of packet, my rule's script is like this:
##########################################################
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -P FORWARD -p tcp -s $REDELOCAL -d 200.228.185.225 --dport 25 -
ACCEPT
iptables -P FORWARD -p tcp -s $REDELOCAL -d 200.228.185.225 --dport 110 -
ACCEPT
##########################################################
Now, i wanna LOG all dropped packets, everyone that try to access other ip
address or port must be log, how can i get it ?
ATs,
Juliano Murlick
SICREDI Serviços - Tecnologia
jmurlick@sicredi.com.br
(51) 3358-4977 / (51) 9951-3888
-----Original Message-----
From: Ramin Dousti [mailto:ramin@cannon.eng.us.uu.net]
Sent: sábado, 19 de julho de 2003 19:06
To: Juliano Murlick
Cc: netfilter@lists.netfilter.org
On Sat, Jul 19, 2003 at 02:38:01PM -0300, Juliano Murlick wrote:
> Hello ALL,
> I need log all packet dropped on my firewall, how can i get it ? I
> know how log all that i accept, like this:
If I understand your question correctly:
If you want to log the dropped packets only then you must allow the ones you
want in the beginning of your rule set and the very last rule (right before
the default DROP policy) must be LOG.
Ramin
>
> iptables -A FORWARD -p tcp -s $REDELOCAL --sport 1024:65535 -d $SSHSRV
> --sport 22 -j LOG iptables -A FORWARD -p tcp -s $REDELOCAL --sport
> 1024:65535 -d $SSHSRV --sport 22 -j ACCEPT
>
> i will LOG all packet from ssh connection, but i don't to log all
> packet dropped, my default policy is DROP:
>
> iptables -P FORWARD DROP
>
> please, if anyone knows it ? tell me ....
>
>
> Thanks in advance!
>
> Att,
> Juliano Murlick
>
>
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
>
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Please ... how can i log all packets dropped ?
2003-07-21 12:44 ` Juliano Murlick
@ 2003-07-21 14:29 ` Ramin Dousti
0 siblings, 0 replies; 6+ messages in thread
From: Ramin Dousti @ 2003-07-21 14:29 UTC (permalink / raw)
To: Juliano Murlick; +Cc: 'Ramin Dousti', netfilter
On Mon, Jul 21, 2003 at 09:44:49AM -0300, Juliano Murlick wrote:
>
> Maybe I did my question wrong ... Sorry.
> I wanna LOG all packet dropped, but I don’t wanna do one rule for each port
> or kind of packet, my rule's script is like this:
>
> ##########################################################
> iptables -P INPUT DROP
> iptables -P OUTPUT DROP
> iptables -P FORWARD DROP
>
> iptables -P FORWARD -p tcp -s $REDELOCAL -d 200.228.185.225 --dport 25 -
> ACCEPT
> iptables -P FORWARD -p tcp -s $REDELOCAL -d 200.228.185.225 --dport 110 -
> ACCEPT
Add this here:
iptables -A FORWARD -j LOG --log-level alert
Also the two lines above must be "-A" and not "-P".
So it becomes:
------------------------------
iptables -P FORWARD DROP
iptables -A FORWARD -p tcp -s $REDELOCAL -d 200.228.185.225 --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp -s $REDELOCAL -d 200.228.185.225 --dport 110 -j ACCEPT
iptables -A FORWARD -j LOG --log-level alert
------------------------------
This will only log the unwanted traffic in the FORWARD chain. If you want
other chains to log add something like this to the end of the chains.
Ramin
> ##########################################################
>
> Now, i wanna LOG all dropped packets, everyone that try to access other ip
> address or port must be log, how can i get it ?
>
>
> ATs,
> Juliano Murlick
> SICREDI Serviços - Tecnologia
> jmurlick@sicredi.com.br
> (51) 3358-4977 / (51) 9951-3888
>
>
>
> -----Original Message-----
> From: Ramin Dousti [mailto:ramin@cannon.eng.us.uu.net]
> Sent: sábado, 19 de julho de 2003 19:06
> To: Juliano Murlick
> Cc: netfilter@lists.netfilter.org
>
> On Sat, Jul 19, 2003 at 02:38:01PM -0300, Juliano Murlick wrote:
>
> > Hello ALL,
> > I need log all packet dropped on my firewall, how can i get it ? I
> > know how log all that i accept, like this:
>
> If I understand your question correctly:
> If you want to log the dropped packets only then you must allow the ones you
> want in the beginning of your rule set and the very last rule (right before
> the default DROP policy) must be LOG.
>
> Ramin
>
> >
> > iptables -A FORWARD -p tcp -s $REDELOCAL --sport 1024:65535 -d $SSHSRV
> > --sport 22 -j LOG iptables -A FORWARD -p tcp -s $REDELOCAL --sport
> > 1024:65535 -d $SSHSRV --sport 22 -j ACCEPT
> >
> > i will LOG all packet from ssh connection, but i don't to log all
> > packet dropped, my default policy is DROP:
> >
> > iptables -P FORWARD DROP
> >
> > please, if anyone knows it ? tell me ....
> >
> >
> > Thanks in advance!
> >
> > Att,
> > Juliano Murlick
> >
> >
> >
> >
> > ---
> > Outgoing mail is certified Virus Free.
> > Checked by AVG anti-virus system (http://www.grisoft.com).
> > Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
> >
> ---
> Incoming mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.500 / Virus Database: 298 - Release Date: 10/7/2003
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2003-07-21 14:29 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-07-19 17:38 Please ... how can i log all packets dropped ? Juliano Murlick
2003-07-19 19:49 ` David Busby
2003-07-19 21:01 ` Juliano Murlick
2003-07-19 22:05 ` Ramin Dousti
2003-07-21 12:44 ` Juliano Murlick
2003-07-21 14:29 ` Ramin Dousti
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.