I want to log destination IP addresses in my Ubuntu router. I have two network cards

eth0 -

eth1 - is the GW for all hosts on my network.

The router works perfectly, but I want to log all destination addresses on outgoing traffic through the router. How can I set this up with iptables? Or is there another way to log this?


You would log the traffic with

sudo iptables -I OUTPUT 1 ! -d -j LOG 

Change "" to your netmask

Keep in mind, order is important in iptables, so you may need to put the log in another location or add logs for routing (POSTROUTING), as you wish.

Also keep in mind that this is going to fill your logs. Unless you plan to monitor the logs you may wish to use an alternate method, such as snort (you can configure snort to alert you to certain traffic) or a http proxy (squid if you in a large organization).

You may want to limit your logs

sudo iptables -I OUTPUT 1 ! -d -m limit --limit 5/min -j LOG 

See also https://help.ubuntu.com/community/IptablesHowTo

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.