1

I suspect iptables to refuse some connection attempts I do on some ports. How to view the log of connections refused by iptables?

I use iptables on Kubuntu 14.04 LTS x64.

sudo iptables -v -x -n -L outputs:

francky@francky-Aurora-R4:~$ sudo iptables -v -x -n -L
Chain INPUT (policy ACCEPT 1735891 packets, 225230318 bytes)
    pkts      bytes target     prot opt in     out     source               destination
 6368899 10355529368 fail2ban-ssh  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 3860995 packets, 5648955269 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain fail2ban-ssh (1 references)
    pkts      bytes target     prot opt in     out     source               destination
 6362396 10355135821 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
4
  • 1
    Please post your iptables rule set. i.e. post the output for sudo iptables -v -x -n -L . If your computer is also a router also post sudo iptables -t nat -v -x -n -L. If your iptables rule set has log statements for the blocks then, by default, they should be in /var/log/kern.log and /var/log/syslog. If your iptables rule set does not have log statements, then add them, even if just for a short time for debugging. Nov 24, 2015 at 23:43
  • @DougSmythies Thanks, I've added the output for sudo iptables -v -x -n -L. Nov 25, 2015 at 1:00
  • No, I do not think that iptables is blocking anything. There is a discrepancy between packets going into the fail2ban-ssh chain and what is being returned, but the table is empty. Nov 25, 2015 at 1:06
  • 2
    I think this is probably a duplicate of this question, however I saw your meta post about strange downvotes so I'll try to help with a short answer below (in case this is still unsolved). Good luck. Dec 27, 2016 at 11:24

1 Answer 1

1

Connection blocking with iptables usually relies on fail2ban's ability to monitor log files and track failed authentication attempts. Fail2ban then supplies temporary rules to iptables for blocking connections to IP addresses associated with failed authentication attempts. The number of times and failed connection attempts are configurable, but my point is basically that while you could have iptables start logging to a file, it makes more sense to either check the log files fail2ban monitors directly, or ask iptables to display a list of current rules (since this will include temporarily blocked IP addresses and which rule they were associated with).

TL;DR try sudo iptables -S to list the current status. If any IP addresses are currently being blocked, you'll see them there instantly.

This DigitalOcean 'iptables basics' article is a helpful place to start learning more about essential commands.

2
  • 2
    iptables does not look at any log files, ever. I think you must have meant to write fail2ban there. Jan 5, 2017 at 23:52
  • Whoops, sorry I was thinking about one and typed the other. I'll edit the answer. Thanks for pointing that out! Jan 6, 2017 at 11:56

Not the answer you're looking for? Browse other questions tagged .