Home / server / Questions / 554288
In Process
Eureka Ikara
Asked: 2013-11-12 15:49:40 +0800 CST

options to log Netfilter/iptables - anything better than ulogd?

  • 772

My requirements are to do extensive logging of various iptables rules that must be logged into a file other than Syslog or the Journal.

For some time have been using ulogd that enables setting up custom log files. However ulogd isn't supported in systemd on Fedora, that seems to indicate it is no longer a preferred option, and may be going the way of the dodo bird.

Wondering if there is a newer preferred option? (conntrack doesn't seem to provide full logging to a file.)

EDIT: Ok - some more details. Am using ipset that blocks and or logs traffic from particular countries. So for example, if there is outgoing traffic to particular countries, we need to know about it and investigate further. Having a large volume of logging information from iptables rules going into Syslog (and the new Journal used in Fedora) means that normal Syslog messages are swamped and important messages are being missed due to the volume of iptables logs. Hence we need to separate the normal Syslog messages from the high volume iptables logs

iptables

2 Answers

  1. use the following iptables directive after you run "man iptables"

    -j LOG

    • 1

  2. Perhaps the NFLOG target could be useful to you? I've never used it, but it sounds like it's what you're after?

    This target provides logging of matching packets. When this target is set for a rule, the Linux kernel will pass the packet to the loaded logging backend to log the packet. This is usually used in combination with nfnetlink_log as log‐ ging backend, which will multicast the packet through a netlink socket to the specified multicast group. One or more userspace processes may subscribe to the group to receive the packets. Like LOG, this is a non-terminating target, i.e. rule traversal continues at the next rule.

    (Emphasis added)

    • 1