What is the best way to log traffic trough firewall?

G-Fox · 04-26-2005, 08:37 AM

Hello, everybody who read this message

What is the best way to log traffic trough firewall?
I have linux box with NAT (one external ip) and get mail from my ISP what my external ip is infected by virus. They sent my logs of virus activity, but in my linux box I don't make any logs and can't find which internal pc is infected... So I decided to start logging everything to find out in future witch pc is infected.

Thanks for any answer.

BinaryBob · 05-04-2005, 01:31 PM

Assuming IP tables is your firewall...

I'm pretty sure running these commands on the firewall/Nat box will log all the packets that the machine uses locally.

Code:

iptables -A INPUT -j LOG
iptables -A OUTPUT -j LOG

And this command should log all the traffic NOT for the machine itself (ie- natted sutff):

Code:

iptables -A FORWARD -j LOG

If anyone has corrections to this, please speak up, I'm no firewall pro.

Good luck.

mrcheeks · 05-04-2005, 01:38 PM

i use ULOGD daemon for firewall login

G-Fox · 05-04-2005, 01:55 PM

Thanks for info