Ulogdrop

gabsik · 05-03-2006, 02:13 PM

What module should i modprobe in an iptables'script for target LOGDROP and if there is , also an ULOGDROP cause i use ULOGD and relative options , thankssssssssss !!!!

Capt_Caveman · 05-04-2006, 08:11 PM

I don't believe there are modules specifically for LOGDROP or ULOGDROP targets. Rather, they are user-defined chains that simply combine the LOG and DROP or ULOG and DROP targets. Like this:

Code:

iptables -N LOGDROP
iptables -A LOGDROP -j LOG
iptables -A LOGDROP -j DROP
iptables <whatever> -j LOGDROP

To use the ULOG target you will need the ULOG module.

gabsik · 05-05-2006, 07:06 PM

I'm actually using ULOG and i use it in iptables , would have been handy an ulogdrop jump but a chain it's not going to work the same way ... !!!!

Capt_Caveman · 05-05-2006, 07:58 PM

Sure it will. Create the user-defined chain named ULOGDROP and then add ULOG and DROP targets to it. Then just use ULOGDROP like it's a normal target. EG:

iptables -N ULOGDROP
iptables -A ULOGDROP -j ULOG
iptables -A ULOGDROP -j DROP
iptables -A INPUT <match some packets> -j ULOGDROP

If that doesn't work for you, maybe you should explain what you are trying to accomplish.

gabsik · 05-05-2006, 10:45 PM

Creating chains it's the only obscure point in creation of iptables rules i have sure because i don't know the potential of it.what you have just showed me opened landscapes to me ...............

gabsik · 05-05-2006, 10:52 PM

I need to log and drop all connections to ports not related to services i have allowed . If i put the above chain at the end of the input chain would i log and drop connections to not accepted ports from 1 to 65535 , i don't want to risk to drop allowed connections as www, mail ecc.
Do you see what i mean ?

Capt_Caveman · 05-06-2006, 07:29 AM

In that case it would log and drop anything that reaches the end of the INPUT chain. So make sure to allow the ports that you want, before reaching the end of the chain. For example:

iptables -N ULOGDROP
iptables -A ULOGDROP -j ULOG
iptables -A ULOGDROP -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -j LOGDROP

So in essence, it is similar to if you had your default INPUT policy set to "LOGDROP". You can also send certain packets to LOGDROP instead, like this (say we only wanted to log and drop packets that came to one port (1433 for example):

iptables -N ULOGDROP
iptables -A ULOGDROP -j ULOG
iptables -A ULOGDROP -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 1433 -j LOGDROP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT

Hope that helps