I am trying to understand IPTABLES -log-prefix in a rule. Here is an example:

Invalid Packet rule

$IPTABLES -A LINVALID -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=INVALID:1 a=DROP "

TCP-Packets with one more bad flags

$IPTABLES -A LBADFLAG -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=BADFLAG:1 a=DROP "

In the first rule the part that says " -j LOG --log-prefix "fp=INVALID:1 a=DROP ". What does that -LOG --log-prefix mean and is the LOG another rule and is it saying jump to that LOG rule. where does this log information go? ex /var/log/messages

what does "fp=BADFLAG:1 a=DROP " mean and will this show up in the log.

third, how can I custom my logging to where I can create different files for each log rule or can I just have all of these logs go to one file instead of the /var/log/messages log. thanks

Its actually -j LOG --log-prefix and the -j means jump to the LOG chain. Yes the logging should be in /var/log/messages but that is probably determined in /etc/syslog.conf file.

that is only a prefix which the kernel will put on the message and yes it will show up in the log.

I'm sure the logs will all be in the same file, that is determined by the priority of the kernel message and all iptables logs will be at the same priority (I think). But as I said before you can edit /etc/syslog.conf and set where the messages go, if you want they can all go to a console.

<edit>man syslog.conf

If I may add to /bin/bash reply: The kernel prints messages only using the facility.priority. Logprefixes are part of the whole message string and do not help determine where that specific message should go. Iptables messages are printed at "kern.info" (but they're not the only ones at that facility.priority level in case you go for redirecting to /dev/console which you shouldn't). The route of the facility.priority is set up in syslog.conf, making it either go to a file, fifo or host. Between syslog and file there is no nice way you can grep for iptables messages. From a syslog fifo you could get messages (and have a nice fat errorprone regex to grep for iptables messages but IMHO any DIY solution that AND slows down the logging process AND isn't 100% foolproof AND isn't 100% errorproof shouldn't be used). Maybe SyslogNG has better facilities but when I tried it some years ago it wasn't good enough.

So, to cut things short, if the only thing you're after is reporting, you could install a daemon like fwlogwatch. It'll extract the loglines from whatever logfile you specify and provide you with a report w/o worrying.

Part of the reason I was asking was because I just overhauled my iptables set of rules and I added alot of extra anti-DDOS,port scans and etc rules to my firewall and I noticed that before I did this upgrade, I was always getting these ssh attempts from script kiddies and now I am not. I also changed my ssh port to another port other then 22.

Jul 19 21:04:33 server sshd[28379]: Illegal user test from XXX.XXX.XXX.XXX
Jul 19 21:04:34 server sshd[28381]: Illegal user guest from XXX.XXX.XXX.XXX
Jul 19 21:04:36 server sshd[28383]: Illegal user admin from XXX.XXX.XXX.XXX
Jul 19 21:04:37 server sshd[28385]: Illegal user admin from XXX.XXX.XXX.XXX
Jul 19 21:04:38 server sshd[28387]: Illegal user user from XXX.XXX.XXX.XXX

With my new firewall I have alot of logging enabled and I was wondering why now I am not seeing these ssh attempts fill my logs. Could it be that they are still be added to my logs but just under another format like:

Sep 28 06:46:48 68-67-253-163 kernel: fp=UDP:2 a=DROP IN=eth0 OUT= MAC=00:01:02:5f:50:06:00:90:f8:01:58:3b:08:00 SRC=xxx.yyy.aaa.ee DST=aa.bb.ccc.ddd LEN=497 TOS=0x00 PREC=0x00 TTL=38 ID=0 DF PROTO=UDP SPT=32867 DPT=1026 LEN=477
Sep 28 06:47:00 68-67-253-163 kernel: fp=UDP:2 a=DROP IN=eth0 OUT= MAC=00:01:02:5f:50:06:00:90:f8:01:58:3b:08:00 SRC=xxx.lll.aaa.ee DST=jj.rrr.ddd.ggg LEN=346 TOS=0x00 PREC=0x00 TTL=38 ID=0 DF PROTO=UDP SPT=44384 DPT=1027 LEN=326

before it was logging sshd crack attempts and now it is not! I dont know right now if what I have done is stopping these attempts or are they still happening and I dont have my firewall configured correctly to log ssh crack attempts?

I was always getting these ssh attempts from script kiddies and now I am not. I also changed my ssh port to another port other then 22.
If someone/something doesn't take the time to do some minor bannergrabbing / fw recon then they won't find your sshd on a non-standard port ("security by obscurity"). BTW, the log excerpt you show is from sshd itself, not the firewall, the logs below that are UDP. To test your fw logging just make some bogus logins on the non-standard port sshd yourself.

I wrote a couple of scripts to tail the /var/log/secure and append iptables rules to drop IPs that I perceive are attacking my machine. The plan is here: http://www.maplepark.com/%7Edrf/cons...llit_Plan.html

I have found it effective

compariing my loging from var/log/mesages from before, why has it changed and I am has the attemps stopped. Can youo tell from what I have posted?

From my var/log/messages

Oct 24 11:12:45 68-67-253-163 kernel: fp=UDP:2 a=DROP IN=eth0 OUT= MAC=00:01:02:5f:50:06:00:90:f8:01:58:3b:08:00 SRC=208.253.1
15.11 DST=68.67.253.163 LEN=28 TOS=0x00 PREC=0x00 TTL=41 ID=16895 PROTO=UDP SPT=12118 DPT=8723 LEN=8

what does the fp=UDP:2 and a=DROP mean ?

Well, that would be the log-prefix specified in the log rule...
If your rule said '--log-prefix "any arbitrary string"' then your log would look like:

Oct 24 11:12:45 68-67-253-163 kernel: any arbitrary string IN=eth0 OUT= MAC=00:01:02:5f:50:06:00:90:f8:01:58:3b:08:00 SRC=208.253.1
15.11 DST=68.67.253.163 LEN=28 TOS=0x00 PREC=0x00 TTL=41 ID=16895 PROTO=UDP SPT=12118 DPT=8723 LEN=8


It looks as though whoever wrote these LOG rules you are using used the --log-prefix to log why the packet was logged (fp=UDP:2) and what will happen to it (a=DROP)

I am using syslog-ng on my systems and it has an excellant filtering mechanism, which I use to filter my iptables log messages to a dedicated file, using the --log-prefix rule the OP is asking about to set a unique identifier.

So: lets say my log prefix is "Dropped and Logged". Now in syslog-ng.conf I set up a filter:
and then simply apply the filter to all messages:
where "src" is the previously defined source of all messages and "droplog" is the previously defined file to log the messages that pass the filter. This is just a simple example, but there are many different filtering methods which allow you to zero in on pretty much any message, and dispatch it accordingly (including sending it to /dev/null if it suits your purposes).

Combining the filter mechanism with its simple but powerful remote logging facilities really puts syslog-ng light years ahead of regular old syslog IMHO.

the LOG target logs using kernel facility. You can change the priority (with --log-level ) but not the facility.
So possible solutions:

1) Choose a priority which has very few/none kernel messages (e.g notice) and send kernel.notice to firewall.log
* Not very good because you can't be sure you won't have kernel messages *

2) Use a shell script to filter all logs that have the prefix you choose (with --log-prefix) to go to a file (firewall.log ?)
* Almost good solution *

3) Use syslog-ng or other syslog daemon which has good filters
* Better solution than 2) *

4) Use ULOG target and ulogd so you have only firewall messages where you want them (file,mysql,etc)
* The best solution IMHO *

5) Use netlink if you use 2.6.14-rcX kernel and new iptables (pkttables)
* Same as 4) *

Gentlemen, that is good stuff. I'll take a look at syslog-ng. thanks.