Logging denied packets (iptables)

[Amadeus W.M.]

On Wed, 17 Oct 2007 12:05:13 -0600, Ashley M. Kirchner wrote:

> One of our offices has several network ranges blocked in iptables
> (essentially '-A INPUT -s www.xxx.yyy.zzz/aa -j DROP').  What I'd like
> to do is create a log entry each time a packet is dropped, IF it matches
> any of those networks.  I think I need to assign all of those networks
> to a "group" and then log dropped packets from that group only.  And
> while I realize this might have other ramifications, such as logs
> growing exponentially, for now we're taking small steps.  Later on I can
> then look for things like logging the same IP only once...
> 
>     So how do I tell iptables to create a group or name, or whatever
> it's called for those ranges, and then log dropped packets from those
> ranges only?  And to be quite honest, all I really care to see in the
> log is something like '[standard log prefix] Packet DROP:
> $source/$destination' (or $source-port/$destination-port) - I don't
> really care for the lengthy log entry that iptables creates, such as
> this example of an SSH-reject:
> 
> Oct 17 11:15:04 queenb kernel: SSH REJECT: IN=eth0 OUT=
> MAC=00:30:48:33:96:22:00:07:50:49:df:7a:08:00 SRC=124.198.16.156
> DST=207.174.xxx.yyy LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=38666 DF
> PROTO=TCP SPT=48226 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0


Essentially, for any DROP rule, have a nearly identical LOG rule, with -j 
LOG --log-prefix "SOME STRING" instead of just -j DROP. 

For instance, I log the new not syn packets like so:

-A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW 
-j LOG --log-prefix "NEW NOT SYN: " 

-A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW 
-j DROP 


Of course, the LOG rule must come before DROP. The rules are identical 
except for the jump part (-j).