LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 04-29-2008, 07:08 AM   #16
hemi_426
Member
 
Registered: Apr 2008
Location: KSA-jeddah
Distribution: CentOS, gentoo, slackware
Posts: 80

Original Poster
Rep: Reputation: 15

it didnt do it
if u want access to my box i will give u ,
i really want to know its not working
 
Old 04-29-2008, 03:06 PM   #17
GhostCow
Member
 
Registered: Aug 2007
Posts: 47

Rep: Reputation: 15
ok i'll see what i can do, check your mail
 
Old 04-30-2008, 12:30 AM   #18
eliufoo
Member
 
Registered: Oct 2007
Posts: 71

Rep: Reputation: 15
Try this..

Quote:
kern.warning /var/log/iptables
It worked for me. Also, don't forget to restart the syslog file. Also, for testing, use the following log parameter.

iptables -I INPUT -j LOG --log-level debug

This will set the rule ontop of the chain and capture everything coming IN.

Elly
 
Old 04-30-2008, 03:14 AM   #19
hemi_426
Member
 
Registered: Apr 2008
Location: KSA-jeddah
Distribution: CentOS, gentoo, slackware
Posts: 80

Original Poster
Rep: Reputation: 15
im trying now
 
Old 04-30-2008, 03:32 AM   #20
hemi_426
Member
 
Registered: Apr 2008
Location: KSA-jeddah
Distribution: CentOS, gentoo, slackware
Posts: 80

Original Poster
Rep: Reputation: 15
sorry to say it ,but still nothing
 
Old 04-30-2008, 05:25 AM   #21
tajamari
Member
 
Registered: Jul 2007
Distribution: Red Hat CentOS Ubuntu FreeBSD OpenSuSe
Posts: 252

Rep: Reputation: 30
Quote:
Originally Posted by GhostCow View Post
restart syslog and check again
don't forget, syslog MUST BE RESTARTED AFTER INITIALIZING LOG RULE
Insert this chain:

# Create chain which blocks new connections, except if coming from inside.
# ----------------------------------------------------------
iptables -N block
iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A block -m state --state NEW -i ! eth0 -j ACCEPT
iptables -A block -j LOG --log-prefix "DROP UNTRUSTED NETWORKS "
iptables -A block -j DROP

Then I edited /etc/syslog.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
kern.* /var/log/firewall.log

You can also add the log file on logrotate.d so it will not accumulate. Dont forget to restart syslog
 
Old 04-30-2008, 04:55 PM   #22
hemi_426
Member
 
Registered: Apr 2008
Location: KSA-jeddah
Distribution: CentOS, gentoo, slackware
Posts: 80

Original Poster
Rep: Reputation: 15
i will test it tomorrow
thanks a lot for ur reply
 
Old 05-01-2008, 02:28 AM   #23
hemi_426
Member
 
Registered: Apr 2008
Location: KSA-jeddah
Distribution: CentOS, gentoo, slackware
Posts: 80

Original Poster
Rep: Reputation: 15
this is the only line i got the whole night
May 1 00:53:58 office kernel: klogd 1.4.1, log source = /proc/kmsg started.
 
Old 05-01-2008, 02:32 AM   #24
hemi_426
Member
 
Registered: Apr 2008
Location: KSA-jeddah
Distribution: CentOS, gentoo, slackware
Posts: 80

Original Poster
Rep: Reputation: 15
#watch -d iptables -nvL
Chain block (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT all -- !eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `DROP UNTRUSTED NETWORKS '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
 
Old 05-01-2008, 02:51 AM   #25
hemi_426
Member
 
Registered: Apr 2008
Location: KSA-jeddah
Distribution: CentOS, gentoo, slackware
Posts: 80

Original Poster
Rep: Reputation: 15
FINALLY I DID IT
i used this line in my syslog.conf
kern.* /var/log/iptables

and these in my iptables
$IPTABLES -A INPUT -p tcp -j LOG --log-level debug
$IPTABLES -A FORWORD -p tcp -j LOG --log-level debug

but is this level of logging give me all kind of traffic passing and blocked packets ?
 
Old 05-01-2008, 02:56 AM   #26
blacky_5251
Member
 
Registered: Oct 2004
Location: Adelaide Hills, South Australia
Distribution: RHEL 4&5, Fedora 10, CentOS 5.4, IPCop
Posts: 569

Rep: Reputation: 55
Give me an IP address and a port number and I'll try to access your server (using ssh). You should be able to watch the attempts come in and being blocked. Pick a weird port number - perhaps 7890.

Happy to try if you want me to. Email me if you don't want to post an IP address.
 
Old 05-01-2008, 03:25 AM   #27
hemi_426
Member
 
Registered: Apr 2008
Location: KSA-jeddah
Distribution: CentOS, gentoo, slackware
Posts: 80

Original Poster
Rep: Reputation: 15
the e-mail is there
but witch code of this line would say that its blocked
example:
May 1 11:22:55 office kernel: IN=eth1 OUT=eth0 SRC=10.0.0.200 DST=77.30.124.216 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=13237 DF PROTO=TCP SPT=1416 DPT=222 WINDOW=16384 RES=0x00 SYN URGP=0
 
Old 05-01-2008, 03:33 AM   #28
blacky_5251
Member
 
Registered: Oct 2004
Location: Adelaide Hills, South Australia
Distribution: RHEL 4&5, Fedora 10, CentOS 5.4, IPCop
Posts: 569

Rep: Reputation: 55
The fact that it gets to your log target means it will hit the DROP target next. So anything in the log should be dropped.

Trying now....

Are you getting anything?
 
Old 05-01-2008, 03:42 AM   #29
hemi_426
Member
 
Registered: Apr 2008
Location: KSA-jeddah
Distribution: CentOS, gentoo, slackware
Posts: 80

Original Poster
Rep: Reputation: 15
yes those lines came in

May 1 11:42:04 office kernel: IN=eth0 OUT= MAC=00:19:e0:0e:b5:f9:00:18:d1:58:a7:4b:08:00 SRC=121.45.139.202 DST=192.168.254.10 LEN=52 TOS=0x00 PREC=0x00 TTL=60 ID=22596 DF PROTO=TCP SPT=80 DPT=51516 WINDOW=25307 RES=0x00 ACK URGP=0

witch part says "blocked" ?
 
Old 05-01-2008, 03:45 AM   #30
hemi_426
Member
 
Registered: Apr 2008
Location: KSA-jeddah
Distribution: CentOS, gentoo, slackware
Posts: 80

Original Poster
Rep: Reputation: 15
i dont have a DROP rule
i have a DROP policy
so everything in my /var/log/iptables is DROPED packets ?
 
  


Reply

Tags
iptables, logging


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables not logging anything~ deeptii Linux - Networking 11 05-31-2006 02:35 AM
Iptables Logging doublejoon Linux - Security 8 01-09-2006 04:20 AM
Iptables logging asterisk Linux - Networking 2 09-04-2004 12:16 AM
iptables logging zsoltrenyi Linux - Software 1 08-19-2004 10:15 AM
I need help on iptables logging FunkFlex Linux - Security 1 01-17-2003 11:43 AM


All times are GMT -5. The time now is 12:44 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration