1

I have set up a simple iptable that should log all dropped packages to a file. When I check my log file it is empty.

My iptables:

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             #Allow loopback
LOGGING    all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain LOGGING (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere             LOG level warning prefix "IPTables-Dropped: "
DROP       all  --  anywhere             anywhere

And in /etc/rsyslog.d/90-iptables.conf I redirect the messages to another file:

:msg,contains,"IPTables-Dropped: " /var/log/iptables.log"

Now changed into

kern.warning      /var/log/iptables.log

Output from sudo iptables -v -x -n -L yields:

    Chain INPUT (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
   58254 11751250 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    3937   232480 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
      52     2824 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
      68     3696 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
     114     9187 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
       0        0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    1636   154417 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0           
      16      668 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 70233 packets, 16508738 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain LOGGING (1 references)
    pkts      bytes target     prot opt in     out     source               destination         
    1641   154653 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4 prefix "IPTables-Dropped: "
    1640   154613 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0 
6
  • Would you be willing to edit your question to show the output for sudo iptables -v -x -n -L instead? That would give us a more complete picture, and also show the packets counters, so that we can see if the LOGGING chain was actually traversed and how many times. Feb 8, 2017 at 17:12
  • Added the requested output. But with options you gave I only got the version but if I removed the -V i got more output.
    – Olof
    Feb 8, 2017 at 18:30
  • lower case "v". I want to see the packet / byte counters and the interfaces. Particularly for your "allow loopback" line. Feb 8, 2017 at 19:09
  • Ahh, updated again with the info.
    – Olof
    Feb 8, 2017 at 20:44
  • If you take out any of your attempts to redirect the log output, do the log entries then appear in /var/log/syslog and /var/log/kern.log, as is the default? Feb 9, 2017 at 1:37

3 Answers 3

1

By convention, only files ending in .conf in /etc/rsyslog.d are looked at by rsyslogd. The default /etc/rsyslogd.conf file contains this:

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

The recommendation is to change the file name from /etc/rsyslog.d/iptables.log to /etc/rsyslog.d/iptables.conf. However, consider to further follow convention and include a load order prefix similar to the other files in that directory. i.e. /etc/rsyslog.d/90-iptables.conf

Note: I tested /etc/rsyslog.d/iptables.conf, and it works fine.

1
  • That was typo from me. It was allready named iptables.conf but i hace not chaged it to 90-iptables.confbut all output is still placed in /var/log/syslog
    – Olof
    Feb 10, 2017 at 14:26
1

This is an old question but it doesn't have an accepted answer, or correct answer as far as I can see. It's do with the order in which the log config files are loaded in the /etc/rsyslog.d/ directory.

I fixed it by prepending my iptables.conf file with 10- so the file name then reads:

10-iptables.conf

This loads it as a higher priority than the 50-defaults.conf file in the same directory, which I assume is overring the behaviour in your iptables log config and directing the logging to the default file location of /var/logs/syslog.

It loads these configs in the alphabetical order so by numbering them you can configure the load priority. The files all need to have the .conf prefix though, because that is what rsyslog looks for when loading log configs.

0

That is because they are logged from the kernel.

You need to change to this in /etc/rsyslog.conf

kern.warning      /var/log/iptables.log
3
  • I changed conf and restarted my rsyslog. Still nothing in the file but I can see them in /var/log/syslog
    – Olof
    Feb 8, 2017 at 13:20
  • @Olof Try commenting out your line :msg,contains... and reload rsyslog
    – fugitive
    Feb 8, 2017 at 14:03
  • Allready did that.
    – Olof
    Feb 8, 2017 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.