Logging connections

Logging connections

[Ashley M. Kirchner]

    I have a hole punched in our iptables configuration for an internet 
application we're using to be able to reach an internal server 
directly.  What I'd like to do now is log the connections that are 
coming in to that port.  Ideally I would want the remote address it's 
coming from, a time stamp and what the connection is wanting to do 
(send/receive.)

    The rules related to that hole are setup like this:

    -A PREROUTING -i eth0 -p tcp -m tcp --dport 6666 -j DNAT 
--to-destination 192.168.x.x
    -A FORWARD -i eth0 -o eth2 -p tcp -m state --state NEW -m tcp 
--dport 6666 --tcp-flags SYN,RST,ACK SYN -j ACCEPT

-- 
H | I haven't lost my mind; it's backed up on tape somewhere.
  +--------------------------------------------------------------------
  Ashley M. Kirchner <mailto:ashley@pcraft.com>   .   303.442.6410 x130
  IT Director / SysAdmin / WebSmith             .     800.441.3873 x130
  Photo Craft Imaging                       .     3550 Arapahoe Ave. #6
  http://www.pcraft.com ..... .  .    .       Boulder, CO 80303, U.S.A. 

Re: Logging connections

[Eduardo Spremolla]

So add the same rule you have in FORWARD with -j LOG before the ACCEPT
one.

-A FORWARD -i eth0 -o eth2 -p tcp -m state --state NEW -m tcp --dport 6666 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix="punched_hole"
    -A FORWARD -i eth0 -o eth2 -p tcp -m state --state NEW -m tcp --dport 6666 --tcp-flags SYN,RST,ACK SYN -j ACCEPT

On Thu, 2005-06-09 at 10:58 -0600, Ashley M. Kirchner wrote:
>     I have a hole punched in our iptables configuration for an internet 
> application we're using to be able to reach an internal server 
> directly.  What I'd like to do now is log the connections that are 
> coming in to that port.  Ideally I would want the remote address it's 
> coming from, a time stamp and what the connection is wanting to do 
> (send/receive.)
> 
>     The rules related to that hole are setup like this:
> 
>     -A PREROUTING -i eth0 -p tcp -m tcp --dport 6666 -j DNAT 
> --to-destination 192.168.x.x
>     -A FORWARD -i eth0 -o eth2 -p tcp -m state --state NEW -m tcp 
> --dport 6666 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
> 
-- 
Ing. Eduardo Spremolla
Jefe I+D
Antel
Uruguay


Este e-mail y cualquier posible archivo adjunto está dirigido únicamente al destinatario del mensaje y contiene información que puede ser confidencial. Si Ud. no es el destinatario correcto por favor notifique al remitente respondiendo este mensaje y elimine inmediatamente el e-mail y los posibles archivos adjuntos al mismo de su sistema. Está prohibida cualquier utilización, difusión o copia de este e-mail por cualquier persona o entidad que no sean las específicas destinatarias del mensaje. ANTEL no acepta ninguna responsabilidad con respecto a cualquier comunicación que haya sido emitida incumpliendo nuestra Política de Seguridad de la Información.
. . . . . . . . .
This e-mail and any attachment is confidential and is intended solely for the addressee(s). If you are not intended recipient please inform the sender immediately, answering this e-mail and delete it as well as the attached files. Any use, circulation or copy of this e-mail by any person or entity that is not the specific addressee(s) is prohibited. ANTEL is not responsible for any communication emitted without respecting our Information Security Policy.