IP Networking

Good afternoon everyone,
It's the iptables n00b again. valiantly learning and reading (and asking for occasional help when I hit a wall - which I think I just did)

So far I've gotten logging enabled for iptables.

Now, I want to drop AND log an IP connection attempt.

Could some wise eyes please confirm that to drop - AND LOG - an IP there are not one, but two rules which must be stuffed in there?

Let's say I want to prevent connections from 10.1.1.115 and log the attempt. The reading I've done so far seems to say I must do this:

Code:

iptables -A INPUT -s 10.1.1.115 -j LOG --log-prefix 'SWAMP-THING'--log-level 4 #or 7 maybe? I just need date/time/IP

iptables -A INPUT -s 10.1.1.115 -j DROP

I'm guessing there's no way to combine the two into a single command (which for brevity, I could maybe alias somehow?)

Regards & TIA for any suggestions and pointers (and expertise)

putter

Yes, you always need 2 different rules. However, you can create a new chain (eg log-and-drop) that contains those 2 rules, and have your regular chains jump there if needed.

Code:

iptables -N log-and-drop # create new chain
iptables -A log-and-drop -j LOG --log-prefix 'SWAMP-THING'--log-level 4
iptables -A log-and-drop -J DROP

iptables -A INPUT -s 10.1.1.115 -j log-and-drop

You might also want to limit the number of log messages by using the (aptly named) limit module (described here), lest someone DoS' your server by filling the log file.

Wow - thanks on a number of levels for this. First and foremost for absolute clarity. I actually understand the guidance you've given.

Secondly for decoding some of the rather opaque writeups which have touched on this subject elsewhere, but which in themselves were not the easiest to understand.

Third by demystifying two other things (thus causing one of those rare and treasured "Eureka moments") - what a chain is, and what a jump is.

Time to read up on limits, try and "put it all together" and come back with something that hopefully looks ready to test.

Thanks so much, your help is hugely appreciated. Back later.

putter