Home / ubuntu / Questions / 108666
Accepted
Gunnar
Asked: 2012-02-29 14:32:26 +0800 CST

Log destination IP with iptables

  • 772

I want to log destination IP addresses in my Ubuntu router. I have two network cards

eth0 - 10.0.101.254

eth1 - 10.0.101.253

10.0.101.254 is the GW for all hosts on my network.

The router works perfectly, but I want to log all destination addresses on outgoing traffic through the router. How can I set this up with iptables? Or is there another way to log this?

networking iptables log nat

1 Answers

  1. Best Answer

    You would log the traffic with

    sudo iptables -I OUTPUT 1 ! -d 10.0.101.0/24 -j LOG

    Change "10.0.101.0/4" to your netmask

    Keep in mind, order is important in iptables, so you may need to put the log in another location or add logs for routing (POSTROUTING), as you wish.

    Also keep in mind that this is going to fill your logs. Unless you plan to monitor the logs you may wish to use an alternate method, such as snort (you can configure snort to alert you to certain traffic) or a http proxy (squid if you in a large organization).

    You may want to limit your logs 

    sudo iptables -I OUTPUT 1 ! -d 10.0.101.0/24 -m limit --limit 5/min -j LOG

    See also https://help.ubuntu.com/community/IptablesHowTo

    • 1