Home / server / Questions / 944174
In Process
Adam Ryczkowski
Asked: 2018-12-14 03:18:31 +0800 CST

How to let netfilter trigger a userspace hook when logging?

  • 772

I would like to immediately process certain types of packets if/when they arrive with a custom (bash) script.

As NetFilter is kernel space, I understand I need to look for a userspace logging tools so I set my eyes on ulogd (v.2). Unfortunately I can not find functionality that would let me handle incoming packets.

I could let ulogd output into a file, and set a separate process that monitors that file, but it seems to me too much convoluted and complex.

Is there an option to nft or ulogd that I missed, that would let me fire a script any time a certain packet was encountered?

iptables

1 Answers

  1. It depends on what you want to do. I have two options in mind:

    1. Write your own application to handle the packets of interest in completely user-space. Netfilter will just forward the matching packets to your application for processing. This provides you with full control to inspect the packet and then decide what to do.
    2. Use the well-known netfilter LOG target and use a tool fail2ban to catch the log entries and process them as required.
    • 0