From: sean darcy <seandarcy2@gmail.com>
To: netfilter@vger.kernel.org
Subject: Re: does -p udp --dport 5060 not work with -j LOG?
Date: Thu, 01 May 2008 19:36:46 -0400 [thread overview]
Message-ID: <fvdk6f$j6a$1@ger.gmane.org> (raw)
In-Reply-To: <cc86d0010804302023n2b2dbbeu9b7c5f7d80a308cb@mail.gmail.com>
Diego Lacerda wrote:
> Hi, Sean,
>
> I used to put -j LOG on the end of my filter scripts to debug this
> king of problems, because all packets that didn't match with any rule
> will be logged (and then dropped, of course).
> Do you have any other rule in PREROUTING chain about the same IP address?
>
> Could you please show the results of "iptables -L -n -v -t nat", and
> show what rules do you have in filter mathing the "SIP-BEFORE" target
> log (something like "iptables -L -n -v |grep SIP-BEFORE")?
>
> I think that this king of information will help us to help you. :-)
>
> Regards,
> Diego Lacerda.
>
Thanks for the response.
There only one line in my script that uses SIP:
grep SIP firewall-masq
$IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG
--log-prefix "SIP-BEFORE: "
And it's run first:
sh -x firewall-masq
+ IPT=/sbin/iptables
+ /sbin/iptables -F
+ /sbin/iptables -X
+ /sbin/iptables -t nat -A PREROUTING -i external -p udp --dport 5060 -j
LOG --log-prefix 'SIP-BEFORE: '
...........
I don't really understand this output:
iptables -L -n -v -t nat | grep SIP
2 262 LOG udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
144K 24M LOG udp -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
41816 5117K LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix
`SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix
`SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix
`SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix
`SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix
`SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
'
And I'm still logging stuff from the lan if, and all udp ports:
May 1 19:33:00 kernel: SIP-BEFORE: IN=lan OUT=
MAC=00:a0:24:54:28:cb:00:0d:56:6b:d7:11:08:00 SRC=10.10.1
0.138 DST=xxx.yyy.1.21 LEN=67 TOS=0x00 PREC=0x00 TTL=128 ID=32656
PROTO=UDP SPT=1233 DPT=53 LEN=47
May 1 19:33:00 kernel: SIP-BEFORE: IN=lan OUT=
MAC=00:a0:24:54:28:cb:00:0d:56:6b:d7:11:08:00 SRC=10.10.1
0.138 DST=xxx.yyy.0.84 LEN=67 TOS=0x00 PREC=0x00 TTL=128 ID=32657
PROTO=UDP SPT=1233 DPT=53 LEN=47
May 1 19:33:00 kernel: SIP-BEFORE: IN=external OUT=
MAC=00:48:54:8b:ab:29:00:1a:e2:84:bf:3b:08:00 SRC=xxx
.yyy.147.90 DST=xxx.yyy.167.178 LEN=126 TOS=0x04 PREC=0x00 TTL=113
ID=11552 PROTO=UDP SPT=18956 DPT=32375 LEN=106
BTW, this Fedora 6, iptables-1.3.8
sean
next prev parent reply other threads:[~2008-05-01 23:36 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-04-30 22:27 does -p udp --dport 5060 not work with -j LOG? sean darcy
2008-05-01 3:23 ` Diego Lacerda
2008-05-01 23:36 ` sean darcy [this message]
2008-05-01 23:53 ` Steven Kath
2008-05-02 0:45 ` Diego Lacerda
2008-05-02 1:10 ` sean darcy
2008-05-02 1:40 ` Steven Kath
2008-05-02 13:34 ` Jan Engelhardt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='fvdk6f$j6a$1@ger.gmane.org' \
--to=seandarcy2@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox