Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I want to log destination IP addresses in my Ubuntu router. I have two network cards

eth0 - 10.0.101.254

eth1 - 10.0.101.253

10.0.101.254 is the GW for all hosts on my network.

The router works perfectly, but I want to log all destination addresses on outgoing traffic through the router. How can I set this up with iptables? Or is there another way to log this?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

You would log the traffic with

sudo iptables -I OUTPUT 1 ! -d 10.0.101.0/24 -j LOG 

Change "10.0.101.0/4" to your netmask

Keep in mind, order is important in iptables, so you may need to put the log in another location or add logs for routing (POSTROUTING), as you wish.

Also keep in mind that this is going to fill your logs. Unless you plan to monitor the logs you may wish to use an alternate method, such as snort (you can configure snort to alert you to certain traffic) or a http proxy (squid if you in a large organization).

You may want to limit your logs

sudo iptables -I OUTPUT 1 ! -d 10.0.101.0/24 -m limit --limit 5/min -j LOG 

See also https://help.ubuntu.com/community/IptablesHowTo

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.