LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices



Reply
 
Search this Thread
Old 10-27-2006, 02:17 PM   #1
J4b0l
LQ Newbie
 
Registered: Oct 2004
Location: Poland
Distribution: Slackware 10
Posts: 13

Rep: Reputation: 0
iptables - logging connections


hello
I use Linux and iptables to SNAT-forward connection to users in my network. my supervisor ordered to log every connection (because of law reasons) and i`m wandering what to log and how to set iptables and firewall and log level because logging every packet is a loads of text data (like 4GB a day).
if anyone should tell me what to log in iptables in order to know every connection between private network (192.168.1.0/24) to internet with information about:
-whose was the connection (private IP from inner network)
-with what (IP from internet)
-both sides ports and protocol

if someone knows how to log activities needed to have this informations i will be very gratefull for any detailed and short information (simply because i lately have no time to read manuals and documentation), or some howto or tutorial covering this info.
 
Old 10-27-2006, 03:00 PM   #2
nayyares
Member
 
Registered: Oct 2006
Location: JNB, SA
Posts: 33

Rep: Reputation: 15
Hi,

if you are running SQUID, then it is already going to squid log files, no need to worry about it btw, there are many SQUID loggers available at sourceforge those will even make a handsome report for internet usage, i forget the name that i used once, but i know there are hundreds of such kind tools available.

thanks
 
Old 10-28-2006, 03:21 AM   #3
J4b0l
LQ Newbie
 
Registered: Oct 2004
Location: Poland
Distribution: Slackware 10
Posts: 13

Original Poster
Rep: Reputation: 0
but i`m not using squid, it`s only iptables nat/firewall, without squid or any proxy, mainly because i have quite poor hardware to use on this purpose. any idea how to do it this way?
if not is there any howto dealing with problem of fully transparent squid for nat (and maybe logging connections)?
 
Old 11-01-2006, 01:28 PM   #4
amitsharma_26
Member
 
Registered: Sep 2005
Location: New delhi
Distribution: RHEL 3.0/4.0
Posts: 777

Rep: Reputation: 31
These below mentioned threads are worth a look.
http://www.linuxquestions.org/questi...hreadid=367803
http://www.linuxquestions.org/questi...d.php?t=385165
 
Old 11-01-2006, 03:21 PM   #5
//////
Member
 
Registered: Nov 2005
Location: Land of Linux :: Finland
Distribution: Dual boot :: Slackware 14.1 64bit multilib | Kali linux 64bit multi lib
Posts: 192

Rep: Reputation: 43
Quote:
Originally Posted by J4b0l
i`m wandering what to log and how to set iptables and firewall and log level because logging every packet is a loads of text data (like 4GB a day).
Hello, you could log only tcp SYN packets, that way you would log only 1 packet per connection.

With udp you obviously need to use some other method.
 
Old 11-01-2006, 06:18 PM   #6
Mortus Canis
LQ Newbie
 
Registered: Jun 2003
Location: Gonzaga University
Distribution: Slackware, RHEL
Posts: 23

Rep: Reputation: 15
Try looking at http://ipaudit.sourceforge.net/

I use it on a server at work to monitor inbound and outbound connections.

It is very easy to install, and the web interface is cool. Make sure you get the IPaudit-Web package, that has a nice installer.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Logging SSH Connections with openSSH alfredofernandeza Linux - Server 4 11-15-2006 07:41 PM
need help with iptables and 2 net connections anthonysaulnier Linux - Security 7 01-28-2006 07:51 AM
Logging off root but retaining network/internet connections Murdock1979 Linux - Security 3 06-30-2005 05:52 PM
iptables and VPN connections lucifercipher Linux - Networking 2 04-05-2005 10:43 AM
logging of imap connections mazzo Linux - Newbie 2 08-06-2003 04:27 AM


All times are GMT -5. The time now is 04:36 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration