bridge logging

bridge logging

[Hurley, Michael]

I've run into an odd snag. 
Set up a bridge to protect a box that can't protect itself. Kernel 2.6.0,
iptables 1.2.9. I'm trying to log some client-server interaction, so I
created this rule:

iptables -A FORWARD -s $client -LOG --log-level 7 --log-prefix "IPT CLIENT:
"
iptables -A FORWARD -d $client -LOG --log-level 7 --log-prefix "IPT CLIENT:
"

FORWARD policy is ACCEPT. There are *no* other rules or chains.

I redirect kern.7 messages into its own log. But no info is getting captured
in there at all. tcpdump sees packets w/ client ip. 

What am I doing wrong and how can I log info going over the bridge to/from a
particular ip?



/***************************************     .-"""-.
Michael Hurley                              '       \ 
Webmaster/SysAdmin                         |,.  ,-.  |
University of Connecticut School of Law    |()L( ()| |
mhurley@law.uconn.edu                      |,'  `".| |
(860) 570-5233                             |.___.',| `
***************************************/  .j `--"' `  `.
                                         / '        '   \
                                        / /          `   `.
                                       / /            `    .
                                      / /              l   |
                                     . ,               |   |
                                     ,"`.             .|   |
                                  _.'   ``.          | `..-'l
                                 |       `.`,        |      `.
                                 |         `.    __.j         )
                                 |__        |--""___|      ,-'
                                    `"--...,+""""   `._,.-' mh

Re: bridge logging

[Jim Cliver]

Hurley, Michael wrote:

> I've run into an odd snag. 
> Set up a bridge to protect a box that can't protect itself. Kernel 2.6.0,
> iptables 1.2.9. I'm trying to log some client-server interaction, so I
> created this rule:
> 
> iptables -A FORWARD -s $client -LOG --log-level 7 --log-prefix "IPT CLIENT:
> "
> iptables -A FORWARD -d $client -LOG --log-level 7 --log-prefix "IPT CLIENT:
> "
> 
> FORWARD policy is ACCEPT. There are *no* other rules or chains.
> 
> I redirect kern.7 messages into its own log. But no info is getting captured
> in there at all. tcpdump sees packets w/ client ip. 
> 
> What am I doing wrong and how can I log info going over the bridge to/from a
> particular ip?
> 
Hello Michael,

If you are attempting to perform this logging on a layer two (bridging) 
device then your logging rules will need to be based upon layer two 
addresses and not layer three (IP).  A bridge ordinarily does not see 
layer three addresses.

Regards,
jim


> 
> 
> /***************************************     .-"""-.
> Michael Hurley                              '       \ 
> Webmaster/SysAdmin                         |,.  ,-.  |
> University of Connecticut School of Law    |()L( ()| |
> mhurley@law.uconn.edu                      |,'  `".| |
> (860) 570-5233                             |.___.',| `
> ***************************************/  .j `--"' `  `.
>                                          / '        '   \
>                                         / /          `   `.
>                                        / /            `    .
>                                       / /              l   |
>                                      . ,               |   |
>                                      ,"`.             .|   |
>                                   _.'   ``.          | `..-'l
>                                  |       `.`,        |      `.
>                                  |         `.    __.j         )
>                                  |__        |--""___|      ,-'
>                                     `"--...,+""""   `._,.-' mh
> 
> 

Bridge Logging

[Chris]

All,

I'm using 4.4.0-89-generic #112-Ubuntu Kernel.

I've setup a bridge

bridge name        bridge id                STP enabled        interfaces
br0                8000.00322e111b2        no                enp3s0
                                                        vnet0

Why is it possible to DROP packages from a KVM guest on the host INPUT
chain, but not to LOG them?

I've not loaded any bridge-nf modules. bridge/nf_call_iptables is 0.

- Chris

Re: Bridge Logging

[Chris]

Chris wrote:
> Why is it possible to DROP packages from a KVM guest on the host INPUT
> chain, but not to LOG them?
> I've not loaded any bridge-nf modules. bridge/nf_call_iptables is 0.

Can't reproduce it anymore, sorry.