You are not logged in.
- Topics: Active | Unanswered
Pages: 1
#1 2010-06-08 14:42:03
- starchos
- Member
- Registered: 2010-03-10
- Posts: 26
no logs for iptables
I had to install Arch again, but noticed soon one "fail", no firewall logs in /var/log/ no iptables, no firewall nothing. I use Arno's iptables configuring tool for my iptables. but there has been earlier iptables logs available. how to get them back
Offline
#2 2010-06-09 00:48:48
- fukawi2
- Ex-Administratorino
- From: .vic.au
- Registered: 2007-09-28
- Posts: 6,237
- Website
Re: no logs for iptables
Are there any LOG jump targets defined in your rules?
What is the output of `iptables -nvL` (as root)
Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?
BlueHackers // fscanary // resticctl
Offline
#3 2010-06-09 11:54:19
- starchos
- Member
- Registered: 2010-03-10
- Posts: 26
Re: no logs for iptables
iptables -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1042 857K BASE_INPUT_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0
2 80 INPUT_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0
2 80 HOST_BLOCK_SRC all -- * * 0.0.0.0/0 0.0.0.0/0
2 80 SPOOF_CHK all -- * * 0.0.0.0/0 0.0.0.0/0
2 80 VALID_CHK all -- eth1 * 0.0.0.0/0 0.0.0.0/0
0 0 EXT_INPUT_CHAIN !icmp -- eth1 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 EXT_INPUT_CHAIN icmp -- eth1 * 0.0.0.0/0 0.0.0.0/0 state NEW limit: avg 60/sec burst 100
0 0 EXT_ICMP_FLOOD_CHAIN icmp -- eth1 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 VALID_CHK all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 EXT_INPUT_CHAIN !icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 EXT_INPUT_CHAIN icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW limit: avg 60/sec burst 100
0 0 EXT_ICMP_FLOOD_CHAIN icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 POST_INPUT_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 6 prefix `AIF:Dropped INPUT packet: '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 BASE_FORWARD_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 TCPMSS tcp -- * eth1 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
0 0 TCPMSS tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
0 0 FORWARD_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 HOST_BLOCK_SRC all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 HOST_BLOCK_DST all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 EXT_FORWARD_IN_CHAIN all -- eth1 * 0.0.0.0/0 0.0.0.0/0
0 0 EXT_FORWARD_OUT_CHAIN all -- * eth1 0.0.0.0/0 0.0.0.0/0
0 0 EXT_FORWARD_IN_CHAIN all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 EXT_FORWARD_OUT_CHAIN all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 SPOOF_CHK all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 POST_FORWARD_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/min burst 3 LOG flags 0 level 6 prefix `AIF:Dropped FORWARD packet: '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1009 115K BASE_OUTPUT_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0
37 2220 TCPMSS tcp -- * eth1 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
0 0 TCPMSS tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
85 5186 OUTPUT_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0
85 5186 HOST_BLOCK_DST all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -f * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `AIF:Fragment packet: '
0 0 DROP all -f * * 0.0.0.0/0 0.0.0.0/0
85 5186 EXT_OUTPUT_CHAIN all -- * eth1 0.0.0.0/0 0.0.0.0/0
0 0 EXT_OUTPUT_CHAIN all -- * eth0 0.0.0.0/0 0.0.0.0/0
85 5186 POST_OUTPUT_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0
85 5186 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain BASE_FORWARD_CHAIN (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED tcp dpts:1024:65535
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED udp dpts:1024:65535
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
Chain BASE_INPUT_CHAIN (1 references)
pkts bytes target prot opt in out source destination
1013 855K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED tcp dpts:1024:65535
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED udp dpts:1024:65535
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
27 1620 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
Chain BASE_OUTPUT_CHAIN (1 references)
pkts bytes target prot opt in out source destination
897 108K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
27 1620 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
Chain DMZ_FORWARD_IN_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain DMZ_FORWARD_OUT_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain DMZ_INET_FORWARD_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain DMZ_INPUT_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain DMZ_LAN_FORWARD_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain DMZ_OUTPUT_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain EXT_FORWARD_IN_CHAIN (2 references)
pkts bytes target prot opt in out source destination
0 0 VALID_CHK all -- * * 0.0.0.0/0 0.0.0.0/0
Chain EXT_FORWARD_OUT_CHAIN (2 references)
pkts bytes target prot opt in out source destination
Chain EXT_ICMP_FLOOD_CHAIN (2 references)
pkts bytes target prot opt in out source destination
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `AIF:ICMP-unreachable flood: '
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `AIF:ICMP-time-exceeded fld: '
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `AIF:ICMP-param-problem fld: '
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `AIF:ICMP-request(ping) fld: '
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 0 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `AIF:ICMP-reply(pong) flood: '
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 0
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `AIF:ICMP-source-quench fld: '
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `AIF:ICMP(other) flood: '
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain EXT_INPUT_CHAIN (4 references)
pkts bytes target prot opt in out source destination
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:0 limit: avg 6/hour burst 1 LOG flags 0 level 6 prefix `AIF:Port 0 OS fingerprint: '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:0 limit: avg 6/hour burst 1 LOG flags 0 level 6 prefix `AIF:Port 0 OS fingerprint: '
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:0
0 0 POST_INPUT_DROP_CHAIN udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:0
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:0 limit: avg 6/hour burst 5 LOG flags 0 level 6 prefix `AIF:TCP source port 0: '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:0 limit: avg 6/hour burst 5 LOG flags 0 level 6 prefix `AIF:UDP source port 0: '
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:0
0 0 POST_INPUT_DROP_CHAIN udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:0
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:!2049 multiport sports 20,21,22,23,80,110,143,443,993,995 limit: avg 6/hour burst 1 LOG flags 0 level 6 prefix `AIF:Possible DRDOS abuse: '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:!2049 multiport sports 20,21,22,23,80,110,143,443,993,995 limit: avg 6/hour burst 1 LOG flags 0 level 6 prefix `AIF:Possible DRDOS abuse: '
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:!2049 multiport sports 20,21,22,23,80,110,143,443,993,995
0 0 POST_INPUT_DROP_CHAIN udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:!2049 multiport sports 20,21,22,23,80,110,143,443,993,995
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `AIF:ICMP-request: '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `AIF:ICMP-unreachable: '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `AIF:ICMP-time-exceeded: '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `AIF:ICMP-param.-problem: '
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 0
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535 flags:!0x17/0x02 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `AIF:Stealth scan? (UNPRIV): '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:0:1023 flags:!0x17/0x02 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `AIF:Stealth scan? (PRIV): '
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:0:1023 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `AIF:PRIV connect attempt: '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:0:1023 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `AIF:PRIV connect attempt: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `AIF:UNPRIV connect attempt: '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `AIF:UNPRIV connect attempt: '
0 0 POST_INPUT_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 POST_INPUT_DROP_CHAIN udp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 POST_INPUT_DROP_CHAIN icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/min burst 5 LOG flags 0 level 6 prefix `AIF:Connect attempt: '
0 0 POST_INPUT_DROP_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain EXT_OUTPUT_CHAIN (2 references)
pkts bytes target prot opt in out source destination
Chain FORWARD_CHAIN (1 references)
pkts bytes target prot opt in out source destination
Chain HOST_BLOCK_DROP (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `AIF:Blocked host(s): '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain HOST_BLOCK_DST (2 references)
pkts bytes target prot opt in out source destination
Chain HOST_BLOCK_SRC (2 references)
pkts bytes target prot opt in out source destination
Chain INET_DMZ_FORWARD_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain INPUT_CHAIN (1 references)
pkts bytes target prot opt in out source destination
Chain INT_FORWARD_IN_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain INT_FORWARD_OUT_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain INT_INPUT_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain INT_OUTPUT_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain LAN_INET_FORWARD_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain OUTPUT_CHAIN (1 references)
pkts bytes target prot opt in out source destination
Chain POST_FORWARD_CHAIN (1 references)
pkts bytes target prot opt in out source destination
Chain POST_INPUT_CHAIN (2 references)
pkts bytes target prot opt in out source destination
Chain POST_INPUT_DROP_CHAIN (39 references)
pkts bytes target prot opt in out source destination
2 80 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain POST_OUTPUT_CHAIN (1 references)
pkts bytes target prot opt in out source destination
Chain RESERVED_NET_CHK (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 10.0.0.0/8 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `AIF:Class A address: '
0 0 LOG all -- * * 172.16.0.0/12 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `AIF:Class B address: '
0 0 LOG all -- * * 192.168.0.0/16 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `AIF:Class C address: '
0 0 LOG all -- * * 169.254.0.0/16 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `AIF:Class M$ address: '
0 0 LOG all -- * * 224.0.0.0/24 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `AIF:Multicast address: '
0 0 LOG all -- * * 239.0.0.0/24 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `AIF:Multicast address: '
0 0 POST_INPUT_DROP_CHAIN all -- * * 10.0.0.0/8 0.0.0.0/0
0 0 POST_INPUT_DROP_CHAIN all -- * * 172.16.0.0/12 0.0.0.0/0
0 0 POST_INPUT_DROP_CHAIN all -- * * 192.168.0.0/16 0.0.0.0/0
0 0 POST_INPUT_DROP_CHAIN all -- * * 169.254.0.0/16 0.0.0.0/0
0 0 POST_INPUT_DROP_CHAIN all -- * * 224.0.0.0/24 0.0.0.0/0
0 0 POST_INPUT_DROP_CHAIN all -- * * 239.0.0.0/24 0.0.0.0/0
Chain SPOOF_CHK (2 references)
pkts bytes target prot opt in out source destination
2 80 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain VALID_CHK (3 references)
pkts bytes target prot opt in out source destination
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x29 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `AIF:Stealth XMAS scan: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x37 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `AIF:Stealth XMAS-PSH scan: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `AIF:Stealth XMAS-ALL scan: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x01 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `AIF:Stealth FIN scan: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `AIF:Stealth SYN/RST scan: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `AIF:Stealth SYN/FIN scan?: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `AIF:Stealth Null scan: '
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x29
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x37
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x01
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=64 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `AIF:Bad TCP flag(64): '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=128 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `AIF:Bad TCP flag(128): '
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=64
0 0 POST_INPUT_DROP_CHAIN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=128
2 80 POST_INPUT_DROP_CHAIN all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
0 0 LOG all -f * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 1 LOG flags 0 level 4 prefix `AIF:Fragment packet: '
0 0 DROP all -f * * 0.0.0.0/0 0.0.0.0/0Last edited by starchos (2010-06-09 12:12:08)
Offline
#4 2010-06-09 11:57:02
- fukawi2
- Ex-Administratorino
- From: .vic.au
- Registered: 2007-09-28
- Posts: 6,237
- Website
Re: no logs for iptables
That was what 'code' blocks were written for 
So logging is there... How about /etc/syslog-ng.conf?
Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?
BlueHackers // fscanary // resticctl
Offline
#5 2010-06-09 12:08:48
- starchos
- Member
- Registered: 2010-03-10
- Posts: 26
Re: no logs for iptables
@version: 3.0
#
# /etc/syslog-ng.conf
#
options {
stats_freq (0);
flush_lines (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames(off);
use_dns (no);
use_fqdn (no);
create_dirs (no);
keep_hostname (yes);
perm(0640);
group("log");
};
source src {
unix-stream("/dev/log");
internal();
file("/proc/kmsg");
};
destination d_authlog { file("/var/log/auth.log"); };
destination d_syslog { file("/var/log/syslog.log"); };
destination d_cron { file("/var/log/crond.log"); };
destination d_daemon { file("/var/log/daemon.log"); };
destination d_kernel { file("/var/log/kernel.log"); };
destination d_lpr { file("/var/log/lpr.log"); };
destination d_user { file("/var/log/user.log"); };
destination d_uucp { file("/var/log/uucp.log"); };
destination d_mail { file("/var/log/mail.log"); };
destination d_news { file("/var/log/news.log"); };
destination d_ppp { file("/var/log/ppp.log"); };
destination d_debug { file("/var/log/debug.log"); };
destination d_messages { file("/var/log/messages.log"); };
destination d_errors { file("/var/log/errors.log"); };
destination d_everything { file("/var/log/everything.log"); };
destination d_iptables { file("/var/log/iptables.log"); };
destination d_acpid { file("/var/log/acpid.log"); };
destination d_console { usertty("root"); };
# Log everything to tty12
destination console_all { file("/dev/tty12"); };
filter f_auth { facility(auth); };
filter f_authpriv { facility(auth, authpriv); };
filter f_syslog { program(syslog-ng); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kernel { facility(kern) and not filter(f_iptables); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail); };
filter f_news { facility(news); };
filter f_user { facility(user); };
filter f_uucp { facility(cron); };
filter f_news { facility(news); };
filter f_ppp { facility(local2); };
filter f_debug { not facility(auth, authpriv, news, mail); };
filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news, cron) and not program(syslog-ng) and not filter(f_iptables); };
filter f_everything { level(debug..emerg) and not facility(auth, authpriv); };
filter f_emergency { level(emerg); };
filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_crit { level(crit); };
filter f_err { level(err); };
filter f_iptables { match("IN=" value("MESSAGE")) and match("OUT=" value("MESSAGE")); };
filter f_acpid { program("acpid"); };
log { source(src); filter(f_acpid); destination(d_acpid); };
log { source(src); filter(f_authpriv); destination(d_authlog); };
log { source(src); filter(f_syslog); destination(d_syslog); };
log { source(src); filter(f_cron); destination(d_cron); };
log { source(src); filter(f_daemon); destination(d_daemon); };
log { source(src); filter(f_kernel); destination(d_kernel); };
log { source(src); filter(f_lpr); destination(d_lpr); };
log { source(src); filter(f_mail); destination(d_mail); };
log { source(src); filter(f_news); destination(d_news); };
log { source(src); filter(f_ppp); destination(d_ppp); };
log { source(src); filter(f_user); destination(d_user); };
log { source(src); filter(f_uucp); destination(d_uucp); };
#log { source(src); filter(f_debug); destination(d_debug); };
log { source(src); filter(f_messages); destination(d_messages); };
log { source(src); filter(f_err); destination(d_errors); };
log { source(src); filter(f_emergency); destination(d_console); };
log { source(src); filter(f_everything); destination(d_everything); };
log { source(src); filter(f_iptables); destination(d_iptables); };
# Log everything to tty12
#log { source(src); destination(console_all); };Last edited by starchos (2010-06-09 12:13:15)
Offline
#6 2010-06-09 23:09:45
- fukawi2
- Ex-Administratorino
- From: .vic.au
- Registered: 2007-09-28
- Posts: 6,237
- Website
Re: no logs for iptables
Looks good too... And /var/log/iptables.log is definitely empty?
I didn't think to check before, but all the LOG targets in your rules have 0 hits against them, so traffic has matched the logging rules so this may explain why nothing is logging 
Try adding this rule in for testing:
iptables -I OUTPUT -m state --state NEW -j LOG(Thanks for wrapping the rules output in code tags too btw )
Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?
BlueHackers // fscanary // resticctl
Offline
#7 2010-06-10 15:00:19
- starchos
- Member
- Registered: 2010-03-10
- Posts: 26
Re: no logs for iptables
it propapbly were so that there was no hits, now I have some logs in /var/log/iptables.log thanks for help. should I remove that iptables rule which you gave/how to do that?
Offline
#8 2010-06-10 23:45:50
- fukawi2
- Ex-Administratorino
- From: .vic.au
- Registered: 2007-09-28
- Posts: 6,237
- Website
Re: no logs for iptables
iptables -D OUTPUT 1
Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?
BlueHackers // fscanary // resticctl
Offline
Pages: 1