Log destination IP with iptables

Question

I want to log destination IP addresses in my Ubuntu router. I have two network cards

eth0 - 10.0.101.254

eth1 - 10.0.101.253

10.0.101.254 is the GW for all hosts on my network.

The router works perfectly, but I want to log all destination addresses on outgoing traffic through the router. How can I set this up with iptables? Or is there another way to log this?

Answer 1

You would log the traffic with

sudo iptables -I OUTPUT 1 ! -d 10.0.101.0/24 -j LOG 

Change "10.0.101.0/4" to your netmask

Keep in mind, order is important in iptables, so you may need to put the log in another location or add logs for routing (POSTROUTING), as you wish.

Also keep in mind that this is going to fill your logs. Unless you plan to monitor the logs you may wish to use an alternate method, such as snort (you can configure snort to alert you to certain traffic) or a http proxy (squid if you in a large organization).

You may want to limit your logs

sudo iptables -I OUTPUT 1 ! -d 10.0.101.0/24 -m limit --limit 5/min -j LOG 

See also https://help.ubuntu.com/community/IptablesHowTo