Mailing List Archive: logging and dropping packets

I am fairly new to iptables, but I have much experience with ipchains. Here's
something I used in ipchains, but I can't quite find the equivalent in iptables:

/sbin/ipchains -A input -l -j DENY

Is there a way to LOG and DROP a packet in the same rule? Right now I have
translated the above command into two iptables entries:

/sbin/iptables -A INPUT -j LOG
/sbin/iptables -A INPUT -j DROP

The thing is that with ipchains I was confident that my rules were working (it
showed the target of DENY) and adequate by inspecting the DENY entries in
/var/log/messages. However, with the LOG target in iptables, all I see is that
the packet is logged. In theory that should be sufficient, but there is now way
to know that just because I logged the packet that I remembered to DROP it!

Thanks,

Jerry G.

Hello Jerry,

On Wednesday 08 August 2001 13:45, JERRY_GREGORY@udlp.com wrote:
> [...]
> Is there a way to LOG and DROP a packet in the same rule? Right now I have
> translated the above command into two iptables entries:
> /sbin/iptables -A INPUT -j LOG
> /sbin/iptables -A INPUT -j DROP
> [...]

Yes, that's the recommend way for now.
I've made a patch not so long ago to have LOG to become a match
instead of being a target, which would allow us to
log and have any other normal target along (like DROP).

It's should still be regarded as experimental/pending as the
coreteam hasn't decided yet to go for this solution or for
anything better.

You will find the patch to the CVS tree of netfilter here :
http://lists.samba.org/pipermail/netfilter-devel/2001-July/001699.html
Simply apply the patch, make patch-o-matic, choose to include the new log match,
reconfigure and recompile your kernel to take into account the new
log match, then install your kernel and your new iptables package.

Please keep in mind that this solution is temporary as the coreteam
hasn't decided yet whether to go for it or not.

Enjoy,

Fabrice.
--
Fabrice MARIE
Senior R&D Engineer
Celestix Networks
http://www.celestix.com/

"Silly hacker, root is for administrators"
-Unknown