0

I used this configuration for my server:

iptables -F
iptables -A INPUT -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A FORWARD -j ACCEPT
iptables -A INPUT -j LOG
iptables -A OUTPUT -j LOG
iptables -A FORWARD -j LOG

After that I saved config:

iptables-save > /etc/iptables/rules.v4

Now my /etc/iptables/rules.v4 looks that:

# Generated by iptables-save v1.8.7 on Thu Nov 30 13:10:32 2023
*filter
:INPUT ACCEPT [347:25809]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [254:44644]
-A INPUT -j ACCEPT
-A INPUT -j LOG
-A FORWARD -j ACCEPT
-A FORWARD -j LOG
-A OUTPUT -j ACCEPT
-A OUTPUT -j LOG
COMMIT
# Completed on Thu Nov 30 13:10:32 2023
# Generated by iptables-save v1.8.7 on Thu Nov 30 13:10:32 2023
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Thu Nov 30 13:10:32 2023

Also I sucessfuly saved this to netfilter-persistent:

netfilter-persistent save

After saving I changed /etc/rsyslog.d/50-default.conf (added /var/log/iptables.log):

#      Default rules for rsyslog.
#
#                       For more information see rsyslog.conf(5) and /etc/rsyslog.conf

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
#daemon.*                       -/var/log/daemon.log
#kern.*                         -/var/log/kern.log
kern.*                          /var/log/iptables.log
#lpr.*                          -/var/log/lpr.log
mail.*                          -/var/log/mail.log
#user.*                         -/var/log/user.log
mail.err                        /var/log/mail.err
*.emerg                         :omusrmsg:*

Now I restarted all services mentioned above:

systemctl restart iptables
systemctl restart netfilter-persistent
systemctl restart rsyslog

But iptables.log is still empty...

I don't understand, why there's no packets in LOG target:

iptables -L -v -n
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1060 81351 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  699 83429 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4

Thanks for any response.

1
  • I changed iptables config that LOG rule was in front of ACCEPT rule and packets started increasing. After that I changed owner:group to /var/log/iptavles.log to syslog:adm and It started logging into this file.
    – cermofi
    Commented Nov 30, 2023 at 14:39

0

You must log in to answer this question.

Browse other questions tagged .