Linux

Ask something
Discussion Locked

iptables PREROUTING -j LOG

0 helpful
6 replies

by stoker 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I asked this in Linux-Security earlier and got no useful answer.
Linux k 2.4.3, debian woody, iptables v1.2.1
A port mapped statically from ppp0 to a computer on the inside (eth0)

iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 1234 -j DNAT --to-destination 10.1.1.200:4321

This works great.. Now, how can I log these connections?
I would have thought that something like

iptables -A FORWARD -i ppp0 -p tcp --dport 1234 -j LOG

should have done it, but I guess PREROUTING grabs the packet before it even enters the rest of the chain, I tried with INPUT/OUTPUT and changed the fw-script positions to see if putting it in a different location in the
chain would help, but nothing I tried seemed to work... It does log if I remove the PREROUTING rule and specifies log on INPUT.

any clue? (-j LOG is not valid in the -t nat table)

6 replies

by gazz

I use nohup for output logging of a command. I have not tried this for you situation, but it does work for logging my cron jobs. So as an example it would look like:

nohup iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 1234 -j DNAT --to-destination 10.1.1.200:4321

By default nohup writes output to $HOME/nohup.out. You can have the output redirected to a file by adding
> /var/adm/logfile.name
to the end of the line.

Hope this leads you in the right direction.

by stoker

iptables is the firewalling setup for Linux kernel 2.4 (ipfilter), replacement of ipchains. There is no STDOUT or anything like that, firewall rule with destination -j LOG will log to syslog (or similar).
I am trying to log all incoming/forwarded/prerouted-dnat connections. Since I have got no useful answers, it seems like this could be a thing to report to linux security lists.

by kevin anderson

I think prerouting is processed before entering a chain.

What you could do is use IPMASQADM along with the IPPORTFW, and THAT you should be able to log through a chain.

It will be slightly slower, but unless you're doing ALOT this will never be noticable. (port forwarding doesn't stress my p100 w/32 megs of ram on a T1. Utilization rarely reaches 10% actually)

Will that work for you? If so, I'll give a more detailed explanation.

Kev.

by stoker

Even if the solution presented might have worked, me an Kevin agreed it is not a "pretty" way of doing it by mixing iptables with others.
Kevin gave me an answer (by email) which really wasn't the right one, but all the sudden when I was writing a reply I realized how stupid I had been thinking, the log needed to be done on the values after the rewriting done by PRER/DNAT. Result:
iptables -A FORWARD -i ppp0 -d 10.1.1.200 -p tcp --dport 4321 -j LOG --tcp-flags SYN,RST,ACK,FIN SYN
And thats it! :) The syn flag is checked so I only log every connection attempt, not all the data being transfered.

by stoker

Kevin Anderson:
You mean to run ipmasqadm as well as iptables? Some details would be appreciated, thank you :)

This discussion is closed to new replies.