Debian 3.0/r1 iptables LOG target not working

markus1982 · 05-25-2003, 11:30 AM

anybody experienced problems with the log target in Debian 3.0r1 ? I've installed using the bf2.4 option:

kernel: Linux 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i686 unknown (2.4.18-bf install)
iptables: v1.2.6a

iptables -A INPUT-j LOG
and syslog logs kern.* to /var/log/kern.log

but the log remains empty. with my self-built kernel everything works ... so this looks like a kernel issue ...

dorian33 · 05-25-2003, 11:39 AM

it is probably due to the fact that this line is applied as the last in the INPUT chain. For instance
iptables -A INPUT-j DROP
iptables -A INPUT-j LOG
won't log anything whereas
iptables -A INPUT-j LOG
iptables -A INPUT-j DROP
will do. So try:
iptables -I INPUT-j LOG
which place it in "better" place.

markus1982 · 05-25-2003, 11:46 AM

well first of all it of course can't log anything if you drop the packets before logging. i've set up my rules correctly:

Quote:

Chain INPUT (policy ACCEPT)
target prot opt source destination
LOG all -- anywhere anywhere LOG level warning

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

SIDE NOTE: This is just a test firewall to demonstrate the issue. It should log ALL traffic. And it doesn't log anything at all. If I switch to my self-created kernel it works ... and it should log a damn log in that state ...

bastard23 · 05-25-2003, 04:51 PM

markus,

'grep CONFIG_IP_NF_TARGET_LOG /boot/config-2.4.18-bf2.4' ?

Also, should I just reply on the same thread on HOWTO: securing debian.

Have fun,
chris

markus1982 · 05-25-2003, 04:55 PM

Quote:

'grep CONFIG_IP_NF_TARGET_LOG /boot/config-2.4.18-bf2.4' ?

Well it's built as module ...

Quote:

Also, should I just reply on the same thread on HOWTO: securing debian.

Feel free to reply there with your thouhgs, etc :-)

markus1982 · 05-25-2003, 05:01 PM

BTW I don't have a problem with this issue since I don't use the default kernel anyways ... just caused my notice as I did some debugging ...