IPtables logging not working

Question

I have set up a simple iptable that should log all dropped packages to a file. When I check my log file it is empty.

My iptables:

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             #Allow loopback
LOGGING    all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain LOGGING (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere             LOG level warning prefix "IPTables-Dropped: "
DROP       all  --  anywhere             anywhere

And in /etc/rsyslog.d/90-iptables.conf I redirect the messages to another file:

:msg,contains,"IPTables-Dropped: " /var/log/iptables.log"

Now changed into

kern.warning      /var/log/iptables.log

Output from sudo iptables -v -x -n -L yields:

    Chain INPUT (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
   58254 11751250 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    3937   232480 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
      52     2824 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
      68     3696 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
     114     9187 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
       0        0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    1636   154417 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0           
      16      668 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 70233 packets, 16508738 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain LOGGING (1 references)
    pkts      bytes target     prot opt in     out     source               destination         
    1641   154653 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4 prefix "IPTables-Dropped: "
    1640   154613 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0 

Answer 1

By convention, only files ending in .conf in /etc/rsyslog.d are looked at by rsyslogd. The default /etc/rsyslogd.conf file contains this:

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

The recommendation is to change the file name from /etc/rsyslog.d/iptables.log to /etc/rsyslog.d/iptables.conf. However, consider to further follow convention and include a load order prefix similar to the other files in that directory. i.e. /etc/rsyslog.d/90-iptables.conf

Note: I tested /etc/rsyslog.d/iptables.conf, and it works fine.

Answer 2

This is an old question but it doesn't have an accepted answer, or correct answer as far as I can see. It's do with the order in which the log config files are loaded in the /etc/rsyslog.d/ directory.

I fixed it by prepending my iptables.conf file with 10- so the file name then reads:

10-iptables.conf

This loads it as a higher priority than the 50-defaults.conf file in the same directory, which I assume is overring the behaviour in your iptables log config and directing the logging to the default file location of /var/logs/syslog.

It loads these configs in the alphabetical order so by numbering them you can configure the load priority. The files all need to have the .conf prefix though, because that is what rsyslog looks for when loading log configs.

Answer 3

That is because they are logged from the kernel.

You need to change to this in /etc/rsyslog.conf

kern.warning      /var/log/iptables.log