I have this rule in my iptables:
iptables -AINPUT -s 192.168.11.0/24 -j LOG
My question is:
Where is the iptables log file, and how can I change that?
These logs are generated by the kernel, so they go to the file that receives kernel logs:
If you want to redirect these logs to a different file, that can't be done through iptables. It can be done in the configuration of the program that dispatches logs: rsyslog. In the iptables rule, add a prefix that isn't used by any other kernel log:
iptables -A INPUT -s 192.168.11.0/24 -j LOG --log-prefix='[netfilter] '
Following the example set by
20-ufw.conf, create a file under
:msg,contains,"[netfilter] " /var/log/iptables.log
If you are in trouble finding the right file you may try like this:
find /var/log -mmin 1
This will find any file modified in the last 1 min inside the
/var/log and below.
You may find out that the
-j LOG may update more than just a single file.
For instance on Ubuntu 18, both the
/var/log/syslog are impacted with netfilter logging.