Change the IPTables log file
An important aspect of any firewall are the log files. Iptables on Linux provides logging functionality, however by default, it will get outputted to the /var/log/messages
log file. This can clutter things up, and make it hard to check the logs.
If you want to change the file that IPTables logs to, you need to set up your iptables rules to output a log prefix. Rsyslog will then be configured to pick up this prefix, and output the information to a custom log file, containing just the iptables
log information.
Install rsyslog
if it is not already installed.
$ sudo apt-get install -y rsyslog
Configure your iptables
firewall rules to output a log prefix using the –log-prefix
command:
$ sudo iptables -A INPUT -p tcp --dport 22 --syn -j LOG --log-prefix "iptables: "
(this will log connection attempts to the SSH port)
Next you need to configure rsyslog
to pickup the iptables
log prefix.
Create an empty rsyslog
conf file for iptables
.
$ sudo touch /etc/rsyslog.d/10-iptables.conf
Open this file up in a file editor.
$ sudo nano /etc/rsyslog.d/10-iptables.conf
Add the following two lines:
:msg, contains, "iptables: " -/var/log/iptables.log & ~
Save the file and exit the editor.
The first line checks the log data for the word “iptables:
” and appends it into the /var/log/iptables.log
file.
The second line simply halts the processing of the log information, so that it doesn’t get logged into /var/log/messages
as well as the iptables.log
file.
Restart rsyslog:
$ sudo service rsyslog restart
The logs should now be appearing in /var/log/iptables.log
You can verify this by tailing the log file:
$ tail -f /var/log/iptables.log
Try and connect to SSH from another machine, and you should see a log entry get created, and appear on the screen automatically.
Eg:
$ tail -f /var/log/iptables.log Feb 20 23:27:11 ubuntu kernel: [1988916.899165] iptables: IN=eth0 OUT= MAC=00:00:00:00:00:00:00: 00:00:00:00:00:00:00 SRC=192.168.0.3 DST=192.168.0.1 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=60148 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0
Close the ‘tail
’ program using Ctrl+c.