Red Hat

I need to log iptables to see what ports are being dropped. I followed this article and several others I looked at via Google, but it's still not working.

Red Hat Magazine | How do I add logging for iptables using the /etc/sysconfig/iptables file for Red Hat Enterprise Linux4?

I added the following entry to my /etc/sysconfig/iptables file just before the last COMMIT line:

Code:

-A RH-Firewall-1-INPUT -p tcp --dport 443 -j ACCEPT #example# 
-A RH-Firewall-1-INPUT -j LOG
COMMIT

I've also tried it as shown:

Code:

-A RH-Firewall-1-INPUT -p tcp --dport 443 -j ACCEPT #example# 
#log
-A RH-Firewall-1-INPUT -j LOG
#drop all other packets
-A RH-Firewall-1-INPUT -j DROP 
COMMIT

My problem is when I got to /var/log/messages I don't see it logging anything whatsoever from iptables.

I also added the following to /etc/syslog.conf:

Code:

kern.*                                                 /var/log/debug

Still no matter what I do no information shows up in any log files, and I've tried numerous ports on this host that I know aren't opened in iptables from another test host in hopes that I would see it logging the dropped connection attempts, but nothing I've done will log anything whatsoever.

I've also tried using this article for advise, but still nothing I do works:
Example iptables firewall

Any advise would be greatly appreciated. This is on Red Hat Enterprise 5.7. Every time I make these changes I of course restart the iptables and syslog services.

anyone have any ideas?

My best guess is that it's not getting as far as the LOG rule in the chain for some reason. Could you post the entire iptables file ?

Try putting a LOG entry before any other processing just to make sure that logging is working...

That fixed it. I just wasn't putting the logging up high enough in the iptables file. Thanks for the tip!

By the way, What entry would work in the /etc/syslog.conf file to capture all iptables logs to a separate log file? That way I can keep my firewall and system logs separate.

Thanks!

I googled

iptables default log level

and got plenty of useful suggestions

Mike