Re: iptables NAT logging

[Grant Taylor <gtaylor@riverviewtech.net>]

On 11/6/2007 9:01 PM, Philip Craig wrote:
> ulogd2 has support for listening to the events, although I haven't 
> tested it recently.  Look for the flow logging options.
> 
> You could also use the 'conntrack' tool to monitor them, and pipe 
> that to a log file.

Interesting.

> This is purely about connection tracking, not filtering, so you can't 
> match up these events with the filter rule that accepted it, unless 
> you encode that in the mark or something.  It will only get events 
> for connections that are accepted by filtering though.

Unless I mis-understand the OP's desires, I don't think the shortcoming 
(if it qualifies as that) of not being able to associate a NetLink event 
with a given IPTables rule is all that big of a deal.  I think the OP 
just needed to log internal and external source and destination IP 
addresses and ports and when the connection started and stopped, thus 
knowing which IPTables rule is (IMHO) a non issue.  I guess depending on 
what someone was trying to do this could be an issue.



Grant. . . .