propper logging and dropping

propper logging and dropping

[Ralph Blach]

Good evening,

I currently have the following macro.

/sbin/iptables -N LOGDROP
/sbin/iptables -A LOGDROP    -i wlan0 ! -s 10.0.0.2 -j LOG --log-level info
/sbin/iptables -A LOGDROP -j DROP
/sbin/iptables -A INPUT -i wlan0 -s    58.102.198.29/255.255.255.0 -j 
LOGDROP

What I really wan to do is log address and excluding certain subnets, 
and address, but drop others on offending networks.
So I want to log addresses to wlan0 whose source address is not 
10.0.0.2, but drop subnets which I exclude.

What is the best way to do this

  Thanks

Chip

Re: propper logging and dropping

[Mart Frauenlob]

netfilter-owner@vger.kernel.org wrote:
> Good evening,
>
> I currently have the following macro.
>
> /sbin/iptables -N LOGDROP
> /sbin/iptables -A LOGDROP    -i wlan0 ! -s 10.0.0.2 -j LOG --log-level 
> info
> /sbin/iptables -A LOGDROP -j DROP
> /sbin/iptables -A INPUT -i wlan0 -s    58.102.198.29/255.255.255.0 -j 
> LOGDROP
>
> What I really wan to do is log address and excluding certain subnets, 
> and address, but drop others on offending networks.
> So I want to log addresses to wlan0 whose source address is not 
> 10.0.0.2, but drop subnets which I exclude.
>
> What is the best way to do this
>
>  Thanks
>
> Chip
>

If I get your question right:

$IPT -N LOGDROP
$IPT -A LOGDROP -s 10.0.0.2 -j RETURN
$IPT -A LOGDROP -j LOG --log-level INFO
$IPT -A LOGDROP -j DROP

$IPT -A INPUT -i wlan0 -s 10.0.0.0/24 -j LOGDROP
$IPT -A INPUT -i wlan0 -s 58.102.198.29/24 -j LOGDROP
...

Regards

Mart

Re: propper logging and dropping

[Ralph Blach]

Mart,

Not Quite, 
                        10.0.0.1          10.0.0.2       ---rest of home 
network 10.0.0.x     
----internet----| firewal | -------Linux server

What I want to do is allow the 10.0.0.x network.
Log packets that are not whose source address are not the  10.0.0.x 
network, with certain exceptions, like the time server and dns server,
Drop and log specifially designated subnets that seem to pound probe 
port 22.

Chip




What I want to do is allow all 10.
Mart Frauenlob wrote:
> netfilter-owner@vger.kernel.org wrote:
>> Good evening,
>>
>> I currently have the following macro.
>>
>> /sbin/iptables -N LOGDROP
>> /sbin/iptables -A LOGDROP    -i wlan0 ! -s 10.0.0.2 -j LOG 
>> --log-level info
>> /sbin/iptables -A LOGDROP -j DROP
>> /sbin/iptables -A INPUT -i wlan0 -s    58.102.198.29/255.255.255.0 -j 
>> LOGDROP
>>
>> What I really wan to do is log address and excluding certain subnets, 
>> and address, but drop others on offending networks.
>> So I want to log addresses to wlan0 whose source address is not 
>> 10.0.0.2, but drop subnets which I exclude.
>>
>> What is the best way to do this
>>
>>  Thanks
>>
>> Chip
>>
>
> If I get your question right:
>
> $IPT -N LOGDROP
> $IPT -A LOGDROP -s 10.0.0.2 -j RETURN
> $IPT -A LOGDROP -j LOG --log-level INFO
> $IPT -A LOGDROP -j DROP
>
> $IPT -A INPUT -i wlan0 -s 10.0.0.0/24 -j LOGDROP
> $IPT -A INPUT -i wlan0 -s 58.102.198.29/24 -j LOGDROP
> ...
>
> Regards
>
> Mart
>

Re: propper logging and dropping

[Ralph Blach]

Mart,

Here is my network setup
my local internet address of my home natted network is 10.0.0.0/255.255.255
My linux server is 10.0.0.2

I want to leave port 22 open so I can remotely ssh into my system.
As you are probably aware there are lots of port probing going on port 22.

What I want to do is this
accept all packets which are local to 10.0.0.0/255.255.255.0 network 
with logging or dropping
accept packets and log packets from the internet, logging them, except 
if they are from certain IP address, like the ntp server, or dns server,
log and drop all packets from a networks which through inspection of the 
logs have tried to break into my server.

Thanks
PS. the reason I sent out the test packet, was because my were not 
getting echo'ed back to me.
The showed up on the list but I never saw them.




interernet | linsys-firewall|------------

Mart Frauenlob wrote:
> netfilter-owner@vger.kernel.org wrote:
>> Good evening,
>>
>> I currently have the following macro.
>>
>> /sbin/iptables -N LOGDROP
>> /sbin/iptables -A LOGDROP    -i wlan0 ! -s 10.0.0.2 -j LOG 
>> --log-level info
>> /sbin/iptables -A LOGDROP -j DROP
>> /sbin/iptables -A INPUT -i wlan0 -s    58.102.198.29/255.255.255.0 -j 
>> LOGDROP
>>
>> What I really wan to do is log address and excluding certain subnets, 
>> and address, but drop others on offending networks.
>> So I want to log addresses to wlan0 whose source address is not 
>> 10.0.0.2, but drop subnets which I exclude.
>>
>> What is the best way to do this
>>
>>  Thanks
>>
>> Chip
>>
>
> If I get your question right:
>
> $IPT -N LOGDROP
> $IPT -A LOGDROP -s 10.0.0.2 -j RETURN
> $IPT -A LOGDROP -j LOG --log-level INFO
> $IPT -A LOGDROP -j DROP
>
> $IPT -A INPUT -i wlan0 -s 10.0.0.0/24 -j LOGDROP
> $IPT -A INPUT -i wlan0 -s 58.102.198.29/24 -j LOGDROP
> ...
>
> Regards
>
> Mart
>