* RE: Chain Policy DROP versus ACCEPT and logging
@ 2003-10-13 15:54 bmcdowell
2003-10-14 1:01 ` Ted Kaczmarek
0 siblings, 1 reply; 6+ messages in thread
From: bmcdowell @ 2003-10-13 15:54 UTC (permalink / raw)
To: blancher, tedkaz; +Cc: netfilter
I may be a little late chiming in on this, but personally my rules use a 'BAD' chain. That chain ends with the LOG and DROP just like a normal appended chain. The difference is, I can explicitly deny things by sending them to -j BAD.
I do the same with -j GOOD, and then run sanity checks against the packet -sending some stuff to BAD before it actually hits the ACCEPT.
-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Cedric Blancher
Sent: Sunday, October 12, 2003 10:12 AM
To: tedkaz@optonline.net
Cc: netfilter@lists.netfilter.org
Subject: Re: Chain Policy DROP versus ACCEPT and logging
Le dim 12/10/2003 à 16:00, Ted Kaczmarek a écrit :
> Is their a way to log the default INPUT and FORWARD policies for dropped
> packets with them set to DROP as opposed to having them set to ACCEPT
> and putting in logs for any deny rules.
Logging in Netfilter does not behave as it used to with ipchains. You
cannot log and drop within the same rule. Suppose you want to log and
drop all UDP traffic :
iptables -A INPUT -p udp -j LOG --log-prefix "UDP dropped : "
iptables -A INPUT -p udp -j DROP
LOG is a target (non terminating one).
This said, if you want to log packets that hit chain policy, then you
have to put a logging rule at the very end of the chain :
iptables -A INPUT -j LOG "INPUT chain policy drop : "
And you're done.
--
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Chain Policy DROP versus ACCEPT and logging
2003-10-13 15:54 Chain Policy DROP versus ACCEPT and logging bmcdowell
@ 2003-10-14 1:01 ` Ted Kaczmarek
2003-10-14 1:29 ` Jeffrey Laramie
0 siblings, 1 reply; 6+ messages in thread
From: Ted Kaczmarek @ 2003-10-14 1:01 UTC (permalink / raw)
To: bmcdowell; +Cc: blancher, netfilter
And that applies to when default input and forward policies are drop?
Having a hard time grasping that in my brain, but I do believe I may be
overheating a few neurons :-)
Ted
On Mon, 2003-10-13 at 11:54, bmcdowell@coxhealthplans.com wrote:
> I may be a little late chiming in on this, but personally my rules use a 'BAD' chain. That chain ends with the LOG and DROP just like a normal appended chain. The difference is, I can explicitly deny things by sending them to -j BAD.
>
> I do the same with -j GOOD, and then run sanity checks against the packet -sending some stuff to BAD before it actually hits the ACCEPT.
>
> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Cedric Blancher
> Sent: Sunday, October 12, 2003 10:12 AM
> To: tedkaz@optonline.net
> Cc: netfilter@lists.netfilter.org
> Subject: Re: Chain Policy DROP versus ACCEPT and logging
>
>
> Le dim 12/10/2003 à 16:00, Ted Kaczmarek a écrit :
> > Is their a way to log the default INPUT and FORWARD policies for dropped
> > packets with them set to DROP as opposed to having them set to ACCEPT
> > and putting in logs for any deny rules.
>
> Logging in Netfilter does not behave as it used to with ipchains. You
> cannot log and drop within the same rule. Suppose you want to log and
> drop all UDP traffic :
>
> iptables -A INPUT -p udp -j LOG --log-prefix "UDP dropped : "
> iptables -A INPUT -p udp -j DROP
>
> LOG is a target (non terminating one).
>
> This said, if you want to log packets that hit chain policy, then you
> have to put a logging rule at the very end of the chain :
>
> iptables -A INPUT -j LOG "INPUT chain policy drop : "
>
> And you're done.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Chain Policy DROP versus ACCEPT and logging
@ 2003-10-12 14:00 Ted Kaczmarek
2003-10-12 15:06 ` Joel Newkirk
2003-10-12 15:12 ` Cedric Blancher
0 siblings, 2 replies; 6+ messages in thread
From: Ted Kaczmarek @ 2003-10-12 14:00 UTC (permalink / raw)
To: netfilter
I have seen many setups where the default CHAIN Policy is to accept
packets by default versus dropping them.
From my perspective a firewall should implicitly deny everything, hence
INPUT and FORWARD should be DROP.
Then rules are put in to allow what you want.
But, one seems to lose some logging capabilities with such a setup.
Is their a way to log the default INPUT and FORWARD policies for dropped
packets with them set to DROP as opposed to having them set to ACCEPT
and putting in logs for any deny rules.
Thanks,
Ted
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Chain Policy DROP versus ACCEPT and logging
2003-10-12 14:00 Ted Kaczmarek
@ 2003-10-12 15:06 ` Joel Newkirk
2003-10-12 15:12 ` Cedric Blancher
1 sibling, 0 replies; 6+ messages in thread
From: Joel Newkirk @ 2003-10-12 15:06 UTC (permalink / raw)
To: tedkaz; +Cc: netfilter
On Sun, 2003-10-12 at 10:00, Ted Kaczmarek wrote:
> I have seen many setups where the default CHAIN Policy is to accept
> packets by default versus dropping them.
> >From my perspective a firewall should implicitly deny everything, hence
> INPUT and FORWARD should be DROP.
> Then rules are put in to allow what you want.
> But, one seems to lose some logging capabilities with such a setup.
> Is their a way to log the default INPUT and FORWARD policies for dropped
> packets with them set to DROP as opposed to having them set to ACCEPT
> and putting in logs for any deny rules.
Yep, just make a log rule last in the chain...
iptables -A FORWARD -j LOG --log-level 7 --log-prefix "FWDDROP:"
for instance. Just remember that any rules added after this cannot
simply be "-A", or they'll be appended after the log rule. They'll
still work properly but the packets they accept would be logged as
having been dropped.
j
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Chain Policy DROP versus ACCEPT and logging
2003-10-12 14:00 Ted Kaczmarek
2003-10-12 15:06 ` Joel Newkirk
@ 2003-10-12 15:12 ` Cedric Blancher
1 sibling, 0 replies; 6+ messages in thread
From: Cedric Blancher @ 2003-10-12 15:12 UTC (permalink / raw)
To: tedkaz; +Cc: netfilter
Le dim 12/10/2003 à 16:00, Ted Kaczmarek a écrit :
> Is their a way to log the default INPUT and FORWARD policies for dropped
> packets with them set to DROP as opposed to having them set to ACCEPT
> and putting in logs for any deny rules.
Logging in Netfilter does not behave as it used to with ipchains. You
cannot log and drop within the same rule. Suppose you want to log and
drop all UDP traffic :
iptables -A INPUT -p udp -j LOG --log-prefix "UDP dropped : "
iptables -A INPUT -p udp -j DROP
LOG is a target (non terminating one).
This said, if you want to log packets that hit chain policy, then you
have to put a logging rule at the very end of the chain :
iptables -A INPUT -j LOG "INPUT chain policy drop : "
And you're done.
--
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2003-10-14 1:29 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-10-13 15:54 Chain Policy DROP versus ACCEPT and logging bmcdowell
2003-10-14 1:01 ` Ted Kaczmarek
2003-10-14 1:29 ` Jeffrey Laramie
-- strict thread matches above, loose matches on Subject: below --
2003-10-12 14:00 Ted Kaczmarek
2003-10-12 15:06 ` Joel Newkirk
2003-10-12 15:12 ` Cedric Blancher
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox