firewall log question

Tyir · 02-12-2004, 09:57 PM

I was tryign to find where my firewall logs were going, and in messages, there didn't seem to be anything.

But recently, iv been using ssh, and the logs for that have been appearing in /var/log/messages

So does that mean all firewall stuff are going there as well? b/c n that case, i don't get much, since nothig is showing up

is it possible the firewall on my router is blocking everything else? I have a linksys wireless router.

chrisfirestar · 02-13-2004, 02:52 AM

have you setup your iptables (im assuming your using this) rules to have logging within in?

eg
$iptables -A INPUT -i $inside -j LOG

?

Tyir · 02-14-2004, 01:28 AM

:|

no...and I'm a little confused with iptables
here is the relevent section:

Code:

###############################################################
# Enable broadcast echo Protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
 
# Disable Source Routed Packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
    echo 0 > $f
done
# Enable TCP SYN Cookie Protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# Disable ICMP Redirect Acceptance
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
    echo 0 > $f
done
# Don't send Redirect Messages
for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
    echo 0 > $f
done
# Drop Spoofed Packets coming in on an interface, which if replied to,
# would result in the reply going out a different interface.   
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
    echo 1 > $f
done
# Do not log packets with impossible addresses.
for f in /proc/sys/net/ipv4/conf/*/log_martians; do
echo 0 > $f
done
###############################################################

# Remove any existing rules from all chains
iptables --flush
iptables -t nat --flush
iptables -t mangle --flush
# Unlimited traffic on the loopback interface
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Set the default policy to drop
iptables --policy INPUT   DROP
iptables --policy OUTPUT  ACCEPT  
iptables --policy FORWARD DROP

iptables -t nat --policy PREROUTING  ACCEPT
iptables -t nat --policy OUTPUT ACCEPT
iptables -t nat --policy POSTROUTING ACCEPT
iptables -t mangle --policy PREROUTING ACCEPT
iptables -t mangle --policy OUTPUT ACCEPT
    
# Remove any pre-existing user-defined chains
iptables --delete-chain
iptables -t nat --delete-chain
iptables -t mangle --delete-chain
    
###############################################################
# Using Connection State to By-pass Rule Checking

iptables -A INPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP

###############################################################
# Stealth Scans and TCP State Flags
# All of the bits are cleared
iptables -A INPUT   -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT   -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT   -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT   -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -A INPUT   -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -A INPUT   -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -A INPUT   -p tcp --tcp-flags ACK,URG URG -j DROP
###############################################################
# Source Address Spoofing and Other Bad Addresses
iptables -A OUTPUT -s ! $EXT_IPADDR -j DROP
iptables -A INPUT  -p ! udp -d $CLASS_D_MULTICAST -j DROP
##############################################################
# ICMP Control and Status Messages
# allow incoming pings from anywhere
iptables -A INPUT  -p icmp --icmp-type echo-request -d $EXT_IPADDR \
             -m state --state NEW -j ACCEPT
# Drop initial ICMP fragments
iptables -A INPUT -p icmp --fragment -j DROP
iptables -A INPUT -p icmp --icmp-type source-quench  -j ACCEPT
iptables -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT

# Intermediate traceroute responses
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

###############################################################
#    Accept the following input requests and ports            #
###############################################################
# reject outside AUTH request.
iptables -A INPUT -p tcp --sport $UNPRIVPORTS --dport 113 -j REJECT --reject-with tcp-reset
###############################################################
# accept outside ssh (TCP Port 22)
iptables -A INPUT -p tcp --sport $UNPRIVPORTS --dport 22 -m state --state NEW -j ACCEPT

Where would I put a line like that?

after each iptables -A INPUT *?

chrisfirestar · 02-15-2004, 08:17 PM

well it depends what you want to be logging really doesnt it..

LOG is a command that wont stop a process so you could place it up the top of the script to capture everything OR you could place it at the end of the script (then drop) everything else so you see what isnt being accepted or dropped through the rest of the script. so think backwards... WHAT YOU WANT TO LOG... then WHERE ARE THOSE PACKETS FIRST FILTERED.. you need it before that

hope that helps